CVE-2006-4218

Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/21484	Patch Vendor Advisory
http://www.gulftech.org/?node=research&article_id=00109-08152006	Exploit
http://www.securityfocus.com/bid/19543
http://www.vupen.com/english/advisories/2006/3283
https://exchange.xforce.ibmcloud.com/vulnerabilities/28395

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zen_cart:zen_cart:1.2.0d:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.1_patch1:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.1d:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.2d:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.3d:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.4.1:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.4d:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.5d:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.2.6d:::::::*
	cpe:2.3:a:zen_cart:zen_cart:1.3.0.2:::::::*

History

No history.

Information

Published : 2006-08-17 23:04

Updated : 2017-07-20 01:32

NVD link : CVE-2006-4218

Mitre link : CVE-2006-4218

CVE.ORG link : CVE-2006-4218

JSON object : View

Products Affected

zen_cart

zen_cart

CWE

NVD-CWE-Other

{"id": "CVE-2006-4218", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-08-17T23:04:00.000", "references": [{"url": "http://secunia.com/advisories/21484", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.gulftech.org/?node=research&article_id=00109-08152006", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/19543", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3283", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28395", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in Zen Cart 1.3.0.2 and earlier allows remote attackers to include and possibly execute arbitrary local files via directory traversal sequences in the typefilter parameter."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en Zen Cart 1.3.0.2 y anteriores permite a atacantes remotos incluir y posiblemente ejecutar archivos locales de su elecci\u00f3n mediante secuencias de salto de directorio en el par\u00e1metro typefilter."}], "lastModified": "2017-07-20T01:32:55.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.0d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86C8BCE1-3959-4CF1-B45D-9C9C5437C7B5"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.1_patch1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9A3AD01-366B-488E-868B-972749150316"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.1d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FB8EFC7-DC11-49D0-BDFB-5C9460459A37"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.2d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69984850-EDA0-4F5E-9F79-48AA660D931B"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.3d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55577877-7456-4AA3-95B9-A3BA7A31B60A"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2CC34F0-22C9-421E-8160-D2A751A1B317"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.4d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAD91623-8C40-45C9-B4AD-6307D5FF2FE9"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.5d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14DF4D70-7368-4048-9E8C-A170B4A21811"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.2.6d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CADD93A8-E710-4348-A738-A8C64C8235D6"}, {"criteria": "cpe:2.3:a:zen_cart:zen_cart:1.3.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9EBE72F-4A37-4D38-B512-CC05C739F33D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}