Description

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.

Remediation

References

CVE-2006-5031

Related Vulnerabilities

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9406)

MediaWiki Improper Authentication Vulnerability (CVE-2021-36128)

WordPress Plugin WP Maps-Display Google Maps Perfectly with Ease Cross-Site Scripting (4.0.4)

ATutor Other Vulnerability (CVE-2015-7712)

XWiki Improper Handling of Insufficient Privileges Vulnerability (CVE-2024-21648)

Severity

Medium

Classification

CVE-2006-5031 CWE-22

Tags

Missing Update Known Vulnerabilities