{"api_version":"1","generated_at":"2026-07-23T06:43:20+00:00","cve":"CVE-2008-0466","urls":{"html":"https://cve.report/CVE-2008-0466","api":"https://cve.report/api/cve/CVE-2008-0466.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-0466","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-0466"},"summary":{"title":"CVE-2008-0466","description":"Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.  NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-01-29 00:00:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-287","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://securityreason.com/securityalert/3584","name":"http://securityreason.com/securityalert/3584","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Web Wiz Rich Text Editor Directory traversal + HTM/HTML filecreation on the server - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.bugreport.ir/?/31","name":"http://www.bugreport.ir/?/31","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BugReport.ir - Security Advisory - Vulnerabilities","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://securitytracker.com/id?1019267","name":"http://securitytracker.com/id?1019267","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Web Wiz Rich Text Editor Input Validation Flaw Lets Remote Users Traverse the Directory and Create HTML Files","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/486868/100/0/threaded","name":"http://www.securityfocus.com/archive/1/486868/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/27419","name":"http://www.securityfocus.com/bid/27419","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Multiple Web Wiz Products Remote Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/4971","name":"https://www.exploit-db.com/exploits/4971","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Web Wiz Rich Text Editor 4.0 Multiple Remote Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/4970","name":"https://www.exploit-db.com/exploits/4970","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Web Wiz Forums <= 9.07 (sub) Remote Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.bugreport.ir/?/29","name":"http://www.bugreport.ir/?/29","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BugReport.ir - Security Advisory - Vulnerabilities","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/486866/100/0/threaded","name":"http://www.securityfocus.com/archive/1/486866/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp","name":"http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Web Wiz Rich Text Editor (RTE) - Release Notes","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0466","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0466","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"466","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"webwiz","cpe5":"web_wiz_forums","cpe6":"9.07","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"466","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"webwiz","cpe5":"web_wiz_newspad","cpe6":"1.02","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"466","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"webwiz","cpe5":"web_wiz_rich_text_editor","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:46:54.540Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20080123 Web Wiz Rich Text Editor Directory traversal + HTM/HTML filecreation on the server","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/486868/100/0/threaded"},{"name":"4970","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/4970"},{"name":"4971","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/4971"},{"name":"27419","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/27419"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.bugreport.ir/?/29"},{"name":"3584","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3584"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.bugreport.ir/?/31"},{"name":"1019267","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1019267"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp"},{"name":"20080123 Web Wiz Forums Directory traversal","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/486866/100/0/threaded"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-01-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.  NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20080123 Web Wiz Rich Text Editor Directory traversal + HTM/HTML filecreation on the server","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/486868/100/0/threaded"},{"name":"4970","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/4970"},{"name":"4971","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/4971"},{"name":"27419","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/27419"},{"tags":["x_refsource_MISC"],"url":"http://www.bugreport.ir/?/29"},{"name":"3584","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3584"},{"tags":["x_refsource_MISC"],"url":"http://www.bugreport.ir/?/31"},{"name":"1019267","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1019267"},{"tags":["x_refsource_MISC"],"url":"http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp"},{"name":"20080123 Web Wiz Forums Directory traversal","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/486866/100/0/threaded"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-0466","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.  NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20080123 Web Wiz Rich Text Editor Directory traversal + HTM/HTML filecreation on the server","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/486868/100/0/threaded"},{"name":"4970","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/4970"},{"name":"4971","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/4971"},{"name":"27419","refsource":"BID","url":"http://www.securityfocus.com/bid/27419"},{"name":"http://www.bugreport.ir/?/29","refsource":"MISC","url":"http://www.bugreport.ir/?/29"},{"name":"3584","refsource":"SREASON","url":"http://securityreason.com/securityalert/3584"},{"name":"http://www.bugreport.ir/?/31","refsource":"MISC","url":"http://www.bugreport.ir/?/31"},{"name":"1019267","refsource":"SECTRACK","url":"http://securitytracker.com/id?1019267"},{"name":"http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp","refsource":"MISC","url":"http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp"},{"name":"20080123 Web Wiz Forums Directory traversal","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/486866/100/0/threaded"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-0466","datePublished":"2008-01-28T23:00:00.000Z","dateReserved":"2008-01-28T00:00:00.000Z","dateUpdated":"2024-08-07T07:46:54.540Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-01-29 00:00:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-287","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:webwiz:web_wiz_forums:9.07:*:*:*:*:*:*:*","matchCriteriaId":"67D078BB-71D4-4182-B733-4EAE579CB949"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:webwiz:web_wiz_newspad:1.02:*:*:*:*:*:*:*","matchCriteriaId":"FA2DDB39-D5DA-4696-BBA8-D7CDE2620949"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:webwiz:web_wiz_rich_text_editor:4.0:*:*:*:*:*:*:*","matchCriteriaId":"069C4645-7B6A-430A-89ED-7BB24286FE52"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"466","Ordinal":"1","Title":"CVE-2008-0466","CVE":"CVE-2008-0466","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"466","Ordinal":"1","NoteData":"Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.  NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.","Type":"Description","Title":"CVE-2008-0466"},{"CveYear":"2008","CveId":"466","Ordinal":"2","NoteData":"2008-01-28","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"466","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}