CVE-2006-3934

CVSS V2 Medium 4 CVSS V3 None
Description
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
Overview
  • CVE ID
  • CVE-2006-3934
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2006-07-31T22:04:00
  • Last Modified Date
  • 2018-10-17T21:32:24
Weakness Enumerations
CWE URL
CWE-22 http://cwe.mitre.org/data/definitions/22.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:* 1 OR 6.2.1
cpe:2.3:a:alkacon:opencms:6.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:alkacon:opencms:6.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:alkacon:opencms:6.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:alkacon:opencms:6.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:alkacon:opencms:6.2:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:S/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 4
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt Exploit Patch
http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip Patch
http://www.opencms.org/opencms/en/shownews.html?id=1002 Patch
http://secunia.com/advisories/21193 Exploit Patch Vendor Advisory
http://securityreason.com/securityalert/1302
https://exchange.xforce.ibmcloud.com/vulnerabilities/28000
http://www.securityfocus.com/archive/1/441182/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2006-3934
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3934
History
Created Old Value New Value Data Type Notes
2022-05-10 18:13:55 Added to TrackCVE