CVE-2006-5750 Path traversal in n/a

High 7.5 Published 27 Nov 2006 Updated 7 Aug 2024

Authenticated attackers can exploit a directory traversal flaw in JBoss AS to read, modify, or potentially execute arbitrary files on the server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2006-5750?

CVE-2006-5750 is a high-severity path traversal vulnerability in n/a, published on 27 Nov 2006. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated users to read or modify arbitrary files, and possibly execute arbitrary code, via unspecified vectors related to the console manager.

Which versions are affected by CVE-2006-5750?

It affects 1 product.

Linux distribution packages (1)

jbossas Red Hat:rhel_application_stack:1 All versions 0:4.0.4-1.el4s1.25

Products include Jboss Jboss Application Server.

How do I fix CVE-2006-5750?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2006-5750 being exploited?

There is no known exploitation of CVE-2006-5750 in the wild and no public exploit code.

Sources

Also known as GHSA-w88w-qrrp-j36h, RHSA-2006:0743.