CVE-2008-2863 Path traversal in n/a
Remote attackers can create or delete arbitrary directories via path traversal in eLineStudio Site Composer, potentially causing data loss or service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-2863?
CVE-2008-2863 is a high-severity path traversal vulnerability in n/a, published on 25 Jun 2008. It can be exploited over the network, with no action from the victim.
Official description
Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer (ESC) 2.6 allow remote attackers to create or delete arbitrary directories via a full pathname in the inpCurrFolder parameter to (1) folderdel_.asp or (2) foldernew.asp in cms/assetmanager/.
Weakness: CWE-22
Which versions are affected by CVE-2008-2863?
It affects 1 product.
Products include Elinestudio Site Composer.
How do I fix CVE-2008-2863?
No fix has been published for CVE-2008-2863 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2008-2863 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-2863 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as CVE-2008-2373, GHSA-xcxj-rfmv-wfv3.