CVE-2008-1606 Path traversal in n/a
Remote attackers can read arbitrary files, list directories, or upload malicious files via path traversal in Elastic Path e-commerce software.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-1606?
CVE-2008-1606 is a medium-severity path traversal vulnerability in n/a, published on 1 Apr 2008. It can be exploited over the network, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in Elastic Path (EP) 4.1 and 4.1.1 allow remote attackers to (1) download arbitrary files via a .. (dot dot) in the file parameter to manager/getImportFileRedirect.jsp, (2) upload arbitrary files via a "..\" (dot dot backslash) in the file parameter to importData.jsp, and (3) list directory contents via a .. (dot dot) in the dir parameter to manager/fileManager.jsp.
Weakness: CWE-22
Which versions are affected by CVE-2008-1606?
It affects 1 product.
Products include Elastic Path Elastic Path.
How do I fix CVE-2008-1606?
No fix has been published for CVE-2008-1606 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2008-1606 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-1606 exists.
Public exploit code: 2 Exploit-DB entries.
Sources
Also known as GHSA-gxrp-448q-jg35.