CVEvulnerability

CVE-2001-1152

7.5 HIGH Published 2001-09-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2001-09-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Baltimore Technologies WEBsweeper 4.02, when used to manage URL blacklists, allows remote attackers to bypass blacklist restrictions and connect to unauthorized web servers by modifying the requested URL, including (1) a // (double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3) a /./, or (4) URL-encoded characters.

Affected configurations

• baltimore technologies websweeper 4.02

Related

Referenced by CWE · observed example (2)

  • CWE-41 Improper Resolution of Path Equivalence weakness
  • CWE-57 Path Equivalence: 'fakedir/../realdir/filename' weakness

References