ServletExec Directory Traversal Vulnerability and Multiple Authentication-Bypass Vulnerabilities

Bugtraq ID:	42411
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 12 2010 12:00AM
Updated:	Aug 12 2010 12:00AM
Credit:	Stefano Di Paola; Giorgio Fedon
Vulnerable:
Not Vulnerable:

ServletExec Directory Traversal Vulnerability and Multiple Authentication-Bypass Vulnerabilities

ServletExec is prone to a directory-traversal vulnerability and multiple authentication-bypass vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to gain administrative access to the affected application and to obtain sensitive information that could aid in further attacks.

Versions prior to ServletExec 6.0.0.2_39 are vulnerable.

ServletExec Directory Traversal Vulnerability and Multiple Authentication-Bypass Vulnerabilities

Attackers can exploit these issues via a browser.

The following example URIs are available:

• /data/vulnerabilities/exploits/42411.txt

ServletExec Directory Traversal Vulnerability and Multiple Authentication-Bypass Vulnerabilities

Solution:
Updates are available. Please see the references for details.

ServletExec Directory Traversal Vulnerability and Multiple Authentication-Bypass Vulnerabilities

References:

• Minded Security Labs: Advisory #MSA260209 (Minded Security)
  
• ServletExec - Homepage (New Atlanta)