Unscored severity · published Jun 4, 2008
CVE-2008-2403
Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages (ASP) Server before 4.0.3 allow remote attackers to read or delete…
–
CVSS
19.4%
EPSS
No
On KEV
Description
Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages (ASP) Server before 4.0.3 allow remote attackers to read or delete arbitrary files via a .. (dot dot) in the Path parameter to the MapPath method.
Exploitation
Is it being used?
Exploit prediction (EPSS)19.4% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Java Asp Server · Sun
through 4.0.2; 4.0; 4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2403
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=707
secunia.com
http://secunia.com/advisories/30523
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1
www.securityfocus.com
http://www.securityfocus.com/bid/29538
www.securitytracker.com
http://www.securitytracker.com/id?1020188
www.vupen.com
http://www.vupen.com/english/advisories/2008/1742/references
More from Java Asp Server
–
CVE-2008-2402
The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote…
–
CVE-2008-2404
Stack-based buffer overflow in the request handling implementation in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to execute arbitrary code via…
–
CVE-2008-2406
The administration application server in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to bypass authentication via direct requests on TCP port…