CVE-2004-2478 Information

Description

Unspecified vulnerability in Jetty HTTP Server as used in (1) IBM Trading Partner Interchange before 4.2.4 (2) CA Unicenter Web Services Distributed Management (WSDM) before 3.11 and possibly other products allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

Reference

http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049846.html http://secunia.com/advisories/12703 http://secunia.com/advisories/22229 http://securitytracker.com/id?1011545 http://securitytracker.com/id?1016975 http://www.osvdb.org/10490 http://www.securityfocus.com/archive/1/447648/100/0/threaded http://www.securityfocus.com/bid/11330 http://www.vupen.com/english/advisories/2006/3873 http://www-1.ibm.com/support/docview.wss?uid=swg21178665 https://exchange.xforce.ibmcloud.com/vulnerabilities/17600