Detections
Analytics
CGI Generic Path Traversal (extended test)
medium Nessus Plugin ID 46195
Language:
Synopsis
Arbitrary files may be accessed or executed on the remote host.Description
The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities.By leveraging this issue, an attacker may be able to read arbitrary files on the web server or execute commands.
Solution
Either restrict access to the vulnerable application or contact the vendor for an update.See Also
https://en.wikipedia.org/wiki/Directory_traversal
http://projects.webappsec.org/w/page/13246952/Path%20Traversal
http://projects.webappsec.org/w/page/13246949/Null%20Byte%20Injection
Plugin Details
Severity: Medium
ID: 46195
File Name: torture_cgi_directory_traversal2.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 4/30/2010
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
Required KB Items: Settings/ThoroughTests, Settings/enable_web_app_tests