CVE-2002-1390 The daemon for GeneWeb before 4.09 does not properly handle requested paths, which allows remote attackers to read arbitrary files via a crafted URL.
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The daemon for GeneWeb before 4.09 does not properly handle requested paths, which allows remote attackers to read arbitrary files via a crafted URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geneweb | = 4.05 | No fix listed |
| geneweb | = 4.06 | No fix listed |
| geneweb | = 4.07 | No fix listed |
| geneweb | = 4.08 | No fix listed |
| debian/geneweb(Debian:11) | < 4.09-1 | 4.09-1 |
References
- cristal.inria.fr
- DSA-223 patch vendor-advisory
- 6549 vdb-entry
- geneweb-absolute-information-disclosure(11021) vdb-entry
- security-tracker.debian.org vendor-advisory