header-logo
Suggest Exploit
vendor:
ServletExec/ISAPI
by:
SecurityFocus
4.3
CVSS
MEDIUM
Directory Traversal
22
CWE
Product Name: ServletExec/ISAPI
Affected Version From: ServletExec/ISAPI 3.0
Affected Version To: ServletExec/ISAPI 4.1
Patch Exists: YES
Related CWE: CVE-2002-0647
CPE: a:newatlanta:servletexec_isapi
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows NT/2000/XP
2002

ServletExec/ISAPI Directory Traversal Vulnerability

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It is vulnerable to a directory traversal attack, which allows an attacker to access arbitrary files within the webroot directory by sending a request containing URL encoded directory traversal sequences.

Mitigation:

Restrict access to the webroot directory and ensure that all files within the webroot directory are not accessible from the web.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4795/info

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems.

ServletExec/ISAPI will disclose the contents of arbitrary files within the webroot directory by sending a request containing URL encoded directory traversal sequences. While this will cause the software to serve files within wwwroot that normally would not be served, it does not appear possible to exploit this condition to break out of the webroot.

http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5c\global.asa

Navigation

Suggest Exploit

Services By CQR