CVE-2008-5116 Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary files in the filesystem...
HighCVSS 7.8
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to read arbitrary files in the filesystem of the IDM server via directory traversal sequences in the ext parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun java system identity manager | = 6.0 | No fix listed |
| sun java system identity manager | = 6.0-sp1 | No fix listed |
| sun java system identity manager | = 6.0-sp2 | No fix listed |
| sun java system identity manager | = 6.0-sp3 | No fix listed |
| sun java system identity manager | = 6.0-sp4 | No fix listed |
| sun java system identity manager | = 7.0 | No fix listed |
| sun java system identity manager | = 7.1 | No fix listed |
References
- 49767 vdb-entry
- 32606 third-party-advisory vendor-advisory
- 243386 patch vendor-advisory
- www.procheckup.com
- 20081119 PR08-09: Unauthenticated File Retrieval on Sun Java System Identity Manager "ext" parameter mailing-list
- 32262 exploit vdb-entry
- 1021170 vdb-entry
- ADV-2008-3128 vdb-entry vendor-advisory
- sun-jsim-unspecified-security-bypass(46554) vdb-entry