Unscored severity · published Dec 31, 2003
CVE-2003-1413
parse_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." sequences in the filename parameter and…
–
CVSS
1.2%
EPSS
No
On KEV
Description
parse_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." sequences in the filename parameter and comparing the resulting error messages.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Darwin Streaming Server · Apple
4.1.2 · source: NVD
QS
Quicktime Streaming Server · Apple
4.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-1413
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-1413
securityreason.com
http://securityreason.com/securityalert/3260
www.securityfocus.com
http://www.securityfocus.com/archive/1/313517
Exploit
http://www.securityfocus.com/bid/6992
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/11445
More from Darwin Streaming Server
7.5
CVE-2004-1083
Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which…
–
CVE-2007-0748
Heap-based buffer overflow in Apple Darwin Streaming Proxy, when using Darwin Streaming Server before 5.5.5, allows remote attackers to execute arbitrary code via multiple trackID…
–
CVE-2007-0749
Multiple stack-based buffer overflows in the is_command function in proxy.c in Apple Darwin Streaming Proxy, when using Darwin Streaming Server before 5.5.5, allow remote…
–
CVE-2005-2195
Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an…
–
CVE-2004-1123
Darwin Streaming Server 5.0.1, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) via a DESCRIBE request with a location that…