CVE-2000-1075 : Detail

CVE-2000-1075

0.62%V3
Network
2001-05-07
02h00 +00:00
2004-09-02
07h00 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Directory traversal vulnerability in iPlanet Certificate Management System 4.2 and Directory Server 4.12 allows remote attackers to read arbitrary files via a .. (dot dot) attack in the Agent, End Entity, or Administrator services.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 5 AV:N/AC:L/Au:N/C:P/I:N/A:N [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 20324

Publication date : 2000-10-24 22h00 +00:00
Author : CORE-SDI
EDB Verified : Yes

source: https://www.securityfocus.com/bid/1839/info Acquiring access to known files outside of the web root is possible through directory traversal techniques in both iPlanet Certificate Management System (CMS). This is made possible through the use of "\../" in a HTTP request. The following services are affected by this vulnerability: - The Agent services server on port 8100/tcp - The End Entity services server on port 443/tcp (Accessible through SSL) - The Administrator services server on a random port configured during installation. https://target/ca/\../\../\../\file.ext
Exploit Database EDB-ID : 20325

Publication date : 2000-10-24 22h00 +00:00
Author : CORE-SDI
EDB Verified : Yes

source: https://www.securityfocus.com/bid/1839/info Acquiring access to known files outside of the web root is possible through directory traversal techniques in Netscape Directory Server. This is made possible through the use of "\../" in a HTTP request. The following services are affected by this vulnerability: - The Agent services server on port 8100/tcp - The End Entity services server on port 443/tcp (Accessible through SSL) - The Administrator services server on a random port configured during installation. https://target/ca/\../\../\../\file.ext

Products Mentioned

Configuraton 0

Netscape>>Directory_server >> Version 4.12

Sun>>Iplanet_certificate_management_system >> Version 4.2

References

http://www.securityfocus.com/bid/1839
Tags : vdb-entry, x_refsource_BID
http://www.osvdb.org/4086
Tags : vdb-entry, x_refsource_OSVDB
http://www.osvdb.org/486
Tags : vdb-entry, x_refsource_OSVDB