CVE-2005-0483 Path traversal in n/a
Authenticated remote attackers can read arbitrary files and list restricted directories via path traversal in Glftpd FTP server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2005-0483?
CVE-2005-0483 is a medium-severity path traversal vulnerability in n/a, published on 19 Feb 2005. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) determine the existence of arbitrary files, (2) list files in restricted directories, or (3) read arbitrary files from within ZIP or gzip files, via .. (dot dot) sequences and globbing ("*") characters in a SITE NFO command.
Which versions are affected by CVE-2005-0483?
It affects 1 product.
Products include Glftpd Glftpd.
How do I fix CVE-2005-0483?
No fix has been published for CVE-2005-0483 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2005-0483 being exploited?
There is no known exploitation of CVE-2005-0483 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-53qv-629p-53cf.