« Volver al listado

CVE-2008-5275

Estado: ModificadaAlta (7.5)—

Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or (2) ZIP archive. NOTE: this can be leveraged for code execution by creating a .php file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Net2ftp — Net2ftp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-5275",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-11-28T19:00:08.517",
  "references": [
    {
      "url": "http://secunia.com/advisories/30611",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://vuln.sg/net2ftp096-en.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/29664",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42994",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/30611",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://vuln.sg/net2ftp096-en.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/29664",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42994",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in the (a) \"Unzip archive\" and (b) \"Upload files and archives\" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or (2) ZIP archive.  NOTE: this can be leveraged for code execution by creating a .php file."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de salto de directorio en las funcionalidades (a) \"Unzip archive\" y (b) \"Upload files and archives\" en et2ftp v0.96 estable y v0.97 beta permite a atacantes remotos crear, leer, o borrar ficheros de su elección a través de .. (punto punto) en un nombre de fichero con un archivo (1) TAR o (2) ZIP.\r\nNOTA: esto se puede aprovechar para la ejecución de código mediante la creación de un fichero .php."
    }
  ],
  "lastModified": "2026-06-16T22:59:36.937",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:net2ftp:net2ftp:0.96:stable:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E15C2167-3D5C-45D6-A3A4-D1AF76E097DC"
            },
            {
              "criteria": "cpe:2.3:a:net2ftp:net2ftp:0.97:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F20497E-1230-4784-9282-C03FDAA1A30A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}