CVE-2005-0332

Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to (1) upload and possibly execute files outside the directory via the AttachmentsKey parameter to attachment.do, as demonstrated using JSP pages, or (2) delete arbitrary files via the select_file parameter to file.do.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=110737616324614&w=2
http://secunia.com/advisories/14116
http://securitytracker.com/id?1013060
http://www.security.org.sg/vuln/desknow2512.html	Vendor Advisory
http://www.securityfocus.com/bid/12421	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/19206
https://exchange.xforce.ibmcloud.com/vulnerabilities/19211
https://exchange.xforce.ibmcloud.com/vulnerabilities/19212

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ventia:desknow_mail_and_collaboration_server:2.5.12:::::::*
	cpe:2.3:a:ventia:desknow_mail_and_collaboration_server:2.5.13:::::::*

History

No history.

Information

Published : 2005-05-02 04:00

Updated : 2017-07-11 01:32

NVD link : CVE-2005-0332

Mitre link : CVE-2005-0332

CVE.ORG link : CVE-2005-0332

JSON object : View

Products Affected

ventia

desknow_mail_and_collaboration_server

CWE

NVD-CWE-Other

{"id": "CVE-2005-0332", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-05-02T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=110737616324614&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/14116", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1013060", "source": "cve@mitre.org"}, {"url": "http://www.security.org.sg/vuln/desknow2512.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/12421", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19206", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19211", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19212", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to (1) upload and possibly execute files outside the directory via the AttachmentsKey parameter to attachment.do, as demonstrated using JSP pages, or (2) delete arbitrary files via the select_file parameter to file.do."}], "lastModified": "2017-07-11T01:32:14.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ventia:desknow_mail_and_collaboration_server:2.5.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6044CCF-674D-4CDE-A3A7-70BA29874388"}, {"criteria": "cpe:2.3:a:ventia:desknow_mail_and_collaboration_server:2.5.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD49EE81-7F8D-479C-BA45-744AE850D81E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}