Xephyrus Java Simple Template Engine File Token Directory Traversal Vulnerability
BID:10953
Info
Xephyrus Java Simple Template Engine File Token Directory Traversal Vulnerability
| Bugtraq ID: | 10953 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 16 2004 12:00AM |
| Updated: | Aug 16 2004 12:00AM |
| Credit: | This vulnerability was announced by the vendor. |
| Vulnerable: |
Xephyrus Java Simple Template Engine (JST) 3.0 (public distro) Xephyrus Java Simple Template Engine (JST) 2.1 (limited distro) Xephyrus Java Simple Template Engine (JST) 2.0 (limited distro) Xephyrus Java Simple Template Engine (JST) 1.1 (limited distro) Xephyrus Java Simple Template Engine (JST) 1.0 (limited distro) Xephyrus Java Simple Template Engine (JST) 0.9 (limited distro) |
| Not Vulnerable: |
Xephyrus Java Simple Template Engine (JST) 3.1 (public distro) |
Discussion
Xephyrus Java Simple Template Engine File Token Directory Traversal Vulnerability
Xephyrus Java Simple Template Engine is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied file-token data.
Xephyrus Java Simple Template Engine permits that files may be loaded into templates using a 'file-token'. However, 'file-token' values may be overridden by URI parameters that are specified in a request for the script that contains 'file-token' entries.
Xephyrus Java Simple Template Engine is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied file-token data.
Xephyrus Java Simple Template Engine permits that files may be loaded into templates using a 'file-token'. However, 'file-token' values may be overridden by URI parameters that are specified in a request for the script that contains 'file-token' entries.
Exploit / POC
Xephyrus Java Simple Template Engine File Token Directory Traversal Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Xephyrus Java Simple Template Engine File Token Directory Traversal Vulnerability
Solution:
The vendor has released an update to address this issue:
Xephyrus Java Simple Template Engine (JST) 0.9 (limited distro)
Xephyrus Java Simple Template Engine (JST) 1.0 (limited distro)
Xephyrus Java Simple Template Engine (JST) 1.1 (limited distro)
Xephyrus Java Simple Template Engine (JST) 2.0 (limited distro)
Xephyrus Java Simple Template Engine (JST) 2.1 (limited distro)
Xephyrus Java Simple Template Engine (JST) 3.0 (public distro)
Solution:
The vendor has released an update to address this issue:
Xephyrus Java Simple Template Engine (JST) 0.9 (limited distro)
-
Xephyrus Java Simple Template Engine JST 3.1
http://www.xephyrus.com/jst/
Xephyrus Java Simple Template Engine (JST) 1.0 (limited distro)
-
Xephyrus Java Simple Template Engine JST 3.1
http://www.xephyrus.com/jst/
Xephyrus Java Simple Template Engine (JST) 1.1 (limited distro)
-
Xephyrus Java Simple Template Engine JST 3.1
http://www.xephyrus.com/jst/
Xephyrus Java Simple Template Engine (JST) 2.0 (limited distro)
-
Xephyrus Java Simple Template Engine JST 3.1
http://www.xephyrus.com/jst/
Xephyrus Java Simple Template Engine (JST) 2.1 (limited distro)
-
Xephyrus Java Simple Template Engine JST 3.1
http://www.xephyrus.com/jst/
Xephyrus Java Simple Template Engine (JST) 3.0 (public distro)
-
Xephyrus Java Simple Template Engine JST 3.1
http://www.xephyrus.com/jst/
References
Xephyrus Java Simple Template Engine File Token Directory Traversal Vulnerability
References:
References:
- Security Advisory JST-001 (Xephyrus)
- Xephyrus Homepage (Xephyrus)