CVE-2004-1399 Directory traversal vulnerability in the Attachment module 2.3.10 and earlier for phpBB allows remote attackers to read arbitrary files via a .. (dot dot) in the filename.
MediumCVSS 5.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the Attachment module 2.3.10 and earlier for phpBB allows remote attackers to read arbitrary files via a .. (dot dot) in the filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opentools attachment mod | = 2.3.4 | No fix listed |
| opentools attachment mod | = 2.3.5 | No fix listed |
| opentools attachment mod | = 2.3.6 | No fix listed |
| opentools attachment mod | = 2.3.7 | No fix listed |
| opentools attachment mod | = 2.3.8 | No fix listed |
| opentools attachment mod | = 2.3.9 | No fix listed |
| opentools attachment mod | = 2.3.10 | No fix listed |
References
- 20041214 phpBB Attachment Mod Directory Traversal HTTP POST Injection mailing-list
- 13421 patch third-party-advisory
- 11893 patch vdb-entry
- attachment-mod-directory-traversal(18437) vdb-entry