Miniwebsvr Web Server Directory Traversal Vulnerability

Bugtraq ID:	22523
Class:	Input Validation Error
CVE:	CVE-2007-0919
Remote:	Yes
Local:	No
Published:	Feb 12 2007 12:00AM
Updated:	May 12 2015 07:34PM
Credit:	Daniel Nyström is credited with the discovery of this vulnerability.
Vulnerable:	Mini Web Server Mini Web Server 0.0.6
Not Vulnerable:

Miniwebsvr Web Server Directory Traversal Vulnerability

Miniwebsvr is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Note that the attacker can traverse to only one directory above the current working directory of the webserver application.

Version 0.0.6 is vulnerable to this issue; other versions may also be affected.

Miniwebsvr Web Server Directory Traversal Vulnerability

Attackers may exploit this vulnerability via a web client.

Miniwebsvr Web Server Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Miniwebsvr Web Server Directory Traversal Vulnerability

References:

• MiniWebsvr home page (MiniWebsvr)
  
• Miniwebsvr 0.0.6 - Directory traversal (=?iso-8859-1?Q?Daniel_Nystr=F6m?= )