CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.4 | $0-$5k | 0.00 |
A vulnerability classified as problematic was found in F-Secure Anti-Virus up to 6.40 on Exchange (Anti-Malware Software). This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, and integrity.
The weakness was shared 11/02/2005 by Mikko Korppi (Website). The advisory is shared for download at f-secure.com. The attack can only be initiated within the local network. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.
Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at ftp.f-secure.com. The best possible mitigation is suggested to be upgrading to the latest version.
The entry 1863 is related to this item.
Product
Type
Vendor
Name
Version
- 6.0
- 6.1
- 6.2
- 6.3
- 6.4
- 6.5
- 6.6
- 6.7
- 6.8
- 6.9
- 6.10
- 6.11
- 6.12
- 6.13
- 6.14
- 6.15
- 6.16
- 6.17
- 6.18
- 6.19
- 6.20
- 6.21
- 6.22
- 6.23
- 6.24
- 6.25
- 6.26
- 6.27
- 6.28
- 6.29
- 6.30
- 6.31
- 6.32
- 6.33
- 6.34
- 6.35
- 6.36
- 6.37
- 6.38
- 6.39
- 6.40
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.6VulDB Meta Temp Score: 4.4
VulDB Base Score: 4.6
VulDB Temp Score: 4.4
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Path traversalCWE: CWE-22
ATT&CK: T1006
Local: No
Remote: Partially
Availability: 🔍
Status: Not defined
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Patch: ftp.f-secure.com
Timeline
11/02/2005 🔍11/07/2005 🔍
07/05/2019 🔍
Sources
Vendor: f-secure.comAdvisory: f-secure.com
Researcher: Mikko Korppi
Status: Not defined
Secunia: 17361 - F-Secure Products Web Console Directory Traversal Vulnerability, Less Critical
See also: 🔍
Entry
Created: 11/07/2005 11:00Updated: 07/05/2019 09:39
Changes: 11/07/2005 11:00 (46), 07/05/2019 09:39 (5)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.