CVEvulnerability
CVE-2010-2695
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-07-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-22
Description
Directory traversal vulnerability in the SFTP/SSH2 virtual server in Xlight FTP Server 3.5.0, 3.5.5, and possibly other versions before 3.6 allows remote authenticated users to read, overwrite, or delete arbitrary files via .. (dot dot) sequences in the (1) ls, (2) rm, (3) rename, and other unspecified commands.
Affected configurations
• xlightftpd xlight ftp server 3.5
• xlightftpd xlight ftp server 3.5.5
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://osvdb.org/66037 osvdb.org
- http://secunia.com/advisories/40473 Vendor Advisory
- http://www.securityfocus.com/archive/1/512192/100/0/threaded www.securityfocus.com
- http://www.xlightftpd.com/whatsnew.htm Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60151 exchange.xforce.ibmcloud.com
- http://osvdb.org/66037 osvdb.org
- http://secunia.com/advisories/40473 Vendor Advisory
- http://www.securityfocus.com/archive/1/512192/100/0/threaded www.securityfocus.com
- http://www.xlightftpd.com/whatsnew.htm Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60151 exchange.xforce.ibmcloud.com