Nokia Electronic Documentation Directory Disclosure Vulnerability

Bugtraq ID:	8624
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 15 2003 12:00AM
Updated:	Sep 15 2003 12:00AM
Credit:	This issue was discovered by @stake.
Vulnerable:	Nokia Nokia Electronic Documentation 5.0
Not Vulnerable:

Nokia Electronic Documentation Directory Disclosure Vulnerability

Nokia Electronic Documentation (NED) is prone to a vulnerability that may enable remote attackers to list directory contents. This issue may be exploited by appending a dot (.) to a request for a NED page. Exploitation will also have the side-effect of disclosing the path to the directory.

This issue was reported for NED installations hosted on WebLogic application servers. It is not known if NED is prone to the same behavior when hosted on other servers. It should be noted that although this vulnerability has been reported to affect Nokia Electronic Documentation version 5.0, previous versions might also be affected.

Nokia Electronic Documentation Directory Disclosure Vulnerability

This issue can be exploited with a web browser. The following example was submitted:

http://www.example.com/docs/NED?action=retrieve&location=.