CWEweakness
CWE-49 Path Equivalence: 'filename/' (Trailing Slash)
- Abstraction
- Variant
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Common consequences
• Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories
Observed examples
• CVE-2002-0253: Overlaps infoleak
• CVE-2001-0446: Application server allows remote attackers to read source code for .jsp files by appending a / to the requested URL.
• CVE-2004-0334: Bypass Basic Authentication for files using trailing "/"
• CVE-2001-0893: Read sensitive files with trailing "/"
• CVE-2001-0892: Web server allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request with a trailing /.
• CVE-2004-1814: Directory traversal vulnerability in server allows remote attackers to read protected files via .. (dot dot) sequences in an HTTP request.
Related
Observed example · CVE (6)
- CVE-2004-1814 Directory traversal vulnerability in VocalTec VGW4/8 Gateway 8.0 allows remote attackers to read protected files via .. vulnerability
- CVE-2004-0334 InnoMedia VideoPhone allows remote attackers to bypass Basic Authorization via an HTTP request to (1) videophone_admindetail.asp, (2)… vulnerability
- CVE-2002-0253 PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an… vulnerability
- CVE-2001-0892 Acme Thttpd Secure Webserver before 2.22, with the chroot option enabled, allows remote attackers to view sensitive files under the… vulnerability
- CVE-2001-0893 Acme mini_httpd before 1.16 allows remote attackers to view sensitive files under the document root (such as .htpasswd) via a GET request… vulnerability
- CVE-2001-0446 IBM WCS (WebSphere Commerce Suite) 4.0.1 with Application Server 3.0.2 allows remote attackers to read source code for .jsp files by… vulnerability