CVEvulnerability

CVE-2004-2478

7.5 HIGH Published 2004-12-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-12-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before 3.11, and possibly other products, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

Affected configurations

• ca unicenter web services distributed management (<= 3.1) • ibm trading partner interchange (<= 4.2.2) • ibm trading partner interchange 4.2.1 • jetty jetty http server 3.1.6 • jetty jetty http server 3.1.7 • jetty jetty http server 4.1.0 • jetty jetty http server 4.1.0 rc4 • jetty jetty http server 4.1.1 • jetty jetty http server 4.2.4 • jetty jetty http server 4.2.5 • jetty jetty http server 4.2.6 • jetty jetty http server 4.2.7 • jetty jetty http server 4.2.9 • jetty jetty http server 4.2.11 • jetty jetty http server 4.2.12 • jetty jetty http server 4.2.14 • jetty jetty http server 4.2.15 • jetty jetty http server 4.2.16 • jetty jetty http server 4.2.17 • jetty jetty http server 4.2.18 • jetty jetty http server 4.2.19

References