« Volver al listado

CVE-2006-3934

Estado: ModificadaMedia (4)—

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Alkacon — Opencms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-3934",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-07-31T22:04:00.000",
  "references": [
    {
      "url": "http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21193",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/1302",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.opencms.org/opencms/en/shownews.html?id=1002",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/441182/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28000",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/21193",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/1302",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.opencms.org/opencms/en/shownews.html?id=1002",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/441182/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28000",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cruce de ruta absoluta en downloadTrigger.jsp en Alkacon OpenCms anterior a 6.2.2 permite a usuarios remotos autenticados bajarse ficheros de su elección mediante un nombre de ruta absoluto en el parámetro filePath."
    }
  ],
  "lastModified": "2026-06-16T22:28:06.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E346469-F1FE-40C0-AC3E-E61121770398",
              "versionEndIncluding": "6.2.1"
            },
            {
              "criteria": "cpe:2.3:a:alkacon:opencms:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8369451E-7C00-4CC3-9B80-871559E3F59E"
            },
            {
              "criteria": "cpe:2.3:a:alkacon:opencms:6.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD4F9A11-BF2F-4C12-AE12-480EE547DD8D"
            },
            {
              "criteria": "cpe:2.3:a:alkacon:opencms:6.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35A4931F-1EA7-48E5-B369-FA013FB87D12"
            },
            {
              "criteria": "cpe:2.3:a:alkacon:opencms:6.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72D23BDD-8C14-44B4-83C3-26F4F35526A1"
            },
            {
              "criteria": "cpe:2.3:a:alkacon:opencms:6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F73D28-272C-4271-BDA1-ACCFA3F8EEDB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "This vulnerability is addressed in the following product release:\r\nAlkacon, OpenCms, 6.2.2"
}