CVE-2002-2375: stalker communigate_pro Path Traversal

Vulnerability summary

CVE-2002-2375 is a medium (CVSS 5.0) Path Traversal vulnerability in stalker communigate_pro. EPSS estimates a 1.53% chance of exploitation in the next 30 days, higher than 74.4% of scored vulnerabilities.

Timeline

1. 31-10-2007
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Directory traversal vulnerability in CommuniGate Pro 4.0b4 and possibly earlier versions allows remote attackers to list the contents of the WebUser directory and its parent directory via a (1) .. (dot dot) or (2) . (dot) in a URL. NOTE: it is not clear whether this issue reveals any more information regarding directory structure than is already available to any CommuniGate Pro user, although there is a possibility that it could be used to infer product version information.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.