Directory traversal vulnerability in Seagull Software Systems J Walk application server 3.2C9, and other versions before 3.3c4, allows remote attackers to read arbitrary files via a ".%252e" (encoded dot dot) in the URL.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Link | Tags |
---|---|
http://secunia.com/advisories/8411 | third party advisory vendor advisory |
http://archives.neohapsis.com/archives/bugtraq/2003-03/0357.html | mailing list |
http://www.securityfocus.com/bid/7160 | vdb entry |
http://www.irmplc.com/advisory/adv5.htm | |
http://www.securitytracker.com/id?1006378 | vdb entry |
http://www.osvdb.org/4927 | vdb entry |
https://exchange.xforce.ibmcloud.com/vulnerabilities/11623 | vdb entry |