Unscored severity · published Dec 31, 2004
CVE-2004-2478
Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before 3.11, and possibly other products, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JH
Jetty Http Server · Jetty
3.1.6; 3.1.7; 4.1.0; 4.1.0_rc4; 4.1.1; 4.2.4; +12 more · source: NVD
TP
Trading Partner Interchange · Ibm
through 4.2.2; 4.2.1 · source: NVD
UW
Unicenter Web Services Distributed Management · CA
through 3.1 · source: NVD
Affected product
UW
Unicenter Web Services Distributed Management
CA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2478
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049846.html
Vendor Advisory
http://secunia.com/advisories/12703
Vendor Advisory
http://secunia.com/advisories/22229
securitytracker.com
http://securitytracker.com/id?1011545
securitytracker.com
http://securitytracker.com/id?1016975
Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg21178665
More from Unicenter Web Services Distributed Management
–
CVE-2005-3653
Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products, in iTechnology iGateway before 4.0.051230, allows remote attackers to…