CVE-2006-3488

Status: ModifiedMedium (5)—

Absolute path traversal vulnerability in administrador.asp in VirtuaStore 2.0 allows remote attackers to possibly read arbitrary directories or files via an absolute path with Windows drive letter in the Pasta parameter when link=util, acao=ftp, and acaba=sim.

CVSS

Version: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Base score: 5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.20%
Percentile among all scored CVEs: 67
Score date: 10/10/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Virtuastore — Virtuastore

CWEs

NVD-CWE-Other

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2006-3488",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-07-10T22:05:00.000",
  "references": [
    {
      "url": "http://securitytracker.com/id?1016421",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1016421",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in administrador.asp in VirtuaStore 2.0 allows remote attackers to possibly read arbitrary directories or files via an absolute path with Windows drive letter in the Pasta parameter when link=util, acao=ftp, and acaba=sim."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de ruta absoluto en administrador.asp in VirtuaStore 2.0 permite a atacantes remotos posiblemente leer directorios o archivos de su elección a través de una ruta absoluta con una letra de dispositivo de Windows en el parámetro Pasta cuando link=util, acao=ftp y acaba=sim."
    }
  ],
  "lastModified": "2026-06-16T22:27:10.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:virtuastore:virtuastore:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "506E6135-7767-4611-BCE8-7AD6FB977318"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}