« Volver al listado

CVE-2008-0466

Estado: ModificadaMedia (5)—

Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files. NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Webwiz — WEB WIZ ForumsWebwiz — WEB WIZ NewspadWebwiz — WEB WIZ Rich Text Editor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-0466",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-01-29T00:00:00.000",
  "references": [
    {
      "url": "http://securityreason.com/securityalert/3584",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1019267",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.bugreport.ir/?/29",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.bugreport.ir/?/31",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/486866/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/486868/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/27419",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4970",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4971",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/3584",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1019267",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.bugreport.ir/?/29",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.bugreport.ir/?/31",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/486866/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/486868/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27419",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.webwizguide.com/webwizrichtexteditor/kb/release_notes.asp",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4970",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4971",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files.  NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability."
    },
    {
      "lang": "es",
      "value": "El archivo RTE_file_browser.asp en Web Wiz, como es  usado en Web Wiz Rich Text Editor versión 4.0, Web Wiz Forums versión 9.07 y Web Wiz Newspad versión 1.02, no requiere autenticación, lo que permite a atacantes remotos enumerar directorios y leer archivos. NOTA: esto puede ser aprovechado para listados fuera del árbol de directorios configurado explotando una vulnerabilidad de salto de directorio separada"
    }
  ],
  "lastModified": "2026-06-16T22:49:41.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webwiz:web_wiz_forums:9.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67D078BB-71D4-4182-B733-4EAE579CB949"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webwiz:web_wiz_newspad:1.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA2DDB39-D5DA-4696-BBA8-D7CDE2620949"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webwiz:web_wiz_rich_text_editor:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "069C4645-7B6A-430A-89ED-7BB24286FE52"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}