CVEvulnerability

CVE-2002-1483

5.0 MEDIUM Published 2003-04-22 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2003-04-22
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N

Description

db4web_c and db4web_c.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument is a filename of the form (1) C: (drive letter), (2) //absolute/path (double-slash), or (3) .. (dot-dot).

Affected configurations

• db4web db4web 3.4 • db4web db4web 3.6

Related

Referenced by CWE · observed example (5)

  • CWE-36 Absolute Path Traversal weakness
  • CWE-39 Path Traversal: 'C:dirname' weakness
  • CWE-41 Improper Resolution of Path Equivalence weakness
  • CWE-50 Path Equivalence: '//multiple/leading/slash' weakness
  • CWE-51 Path Equivalence: '/multiple//internal/slash' weakness

References