CVE-2005-2891

WebArchiveX.dll 5.5.0.76 installed before September 6th, 2005 is marked safe for scripting by default, which allows remote attackers to read or write to arbitrary files via the (1) MakeArchive or (2) MakeArchiveStr methods.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://security-assessment.com/Advisories/WebArchiveX_-_Unsafe_Methods_Vulnerability.pdf	Exploit Vendor Advisory
http://www.securityfocus.com/bid/14760
http://www.securitytracker.com/alerts/2005/Sep/1014867.html	Exploit Vendor Advisory
http://secunia.com/advisories/16722/	Vendor Advisory
http://marc.info/?l=bugtraq&m=112611388014937&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/22188

Configurations

Configuration 1 (hide)

cpe:2.3:a:csystems:webarchivex:5.5.0.76:*:*:*:*:*:*:*

History

No history.

Information

Published : 2005-09-14 20:03

Updated : 2017-07-11 01:33

NVD link : CVE-2005-2891

Mitre link : CVE-2005-2891

JSON object : View

Products Affected

csystems

webarchivex

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://security-assessment.com/Advisories/WebArchiveX_-_Unsafe_Methods_Vulnerability.pdf", "name": "http://security-assessment.com/Advisories/WebArchiveX_-_Unsafe_Methods_Vulnerability.pdf", "tags": ["Exploit", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/14760", "name": "14760", "tags": [], "refsource": "BID"}, {"url": "http://www.securitytracker.com/alerts/2005/Sep/1014867.html", "name": "1014867", "tags": ["Exploit", "Vendor Advisory"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/16722/", "name": "16722", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://marc.info/?l=bugtraq&m=112611388014937&w=2", "name": "20050907 WebArchiveX - Unsafe Methods Vulnerability", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22188", "name": "webarchivex-component-file-manipulation(22188)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "WebArchiveX.dll 5.5.0.76 installed before September 6th, 2005 is marked safe for scripting by default, which allows remote attackers to read or write to arbitrary files via the (1) MakeArchive or (2) MakeArchiveStr methods."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-2891", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-09-14T20:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:csystems:webarchivex:5.5.0.76:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:33Z"}