WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a ".lnk." extension, which bypasses WFTPD's check for a ".lnk" extension.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/archive/1/194442 | Broken Link Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/2957 | Broken Link Exploit Patch Third Party Advisory VDB Entry Vendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/6760 | Third Party Advisory VDB Entry |
| http://www.securityfocus.com/archive/1/194442 | Broken Link Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/2957 | Broken Link Exploit Patch Third Party Advisory VDB Entry Vendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/6760 | Third Party Advisory VDB Entry |
Configurations
History
20 Nov 2024, 23:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/archive/1/194442 - Broken Link, Third Party Advisory, VDB Entry | |
| References | () http://www.securityfocus.com/bid/2957 - Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/6760 - Third Party Advisory, VDB Entry |
Information
Published : 2001-07-01 04:00
Updated : 2025-04-03 01:03
NVD link : CVE-2001-1386
Mitre link : CVE-2001-1386
CVE.ORG link : CVE-2001-1386
JSON object : View
Products Affected
texasimperialsoftware
- wftpd
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')