Abyss Web Server Path Disclosure Vulnerability

vendor:

Abyss Web Server

by:

SecurityFocus

7.5

CVSS

HIGH

Path Disclosure

CWE

Product Name: Abyss Web Server

Affected Version From: 1

Affected Version To: 1.2

Patch Exists: YES

Related CWE: N/A

CPE: a:aprelium:abyss_web_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft Windows, Linux

2002

Abyss Web Server Path Disclosure Vulnerability

Abyss Web Server is vulnerable to a path disclosure vulnerability. A remote attacker can make a specially crafted web request containing encoded dot-dot-slash (../) sequences to disclose the contents of arbitrary web-readable files. This issue may be exploited by a remote attacker to gain access to the administrative configuration file for the web server.

Mitigation:

Upgrade to the latest version of Abyss Web Server.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4466/info

Abyss Web Server is a freely available personal web server. It is maintained by Aprelium Technologies and runs on Microsoft Windows operating systems, as well as Linux.

It is possible for a remote attacker to disclose the contents of arbitrary web-readable files by making a specially crafted web request containing encoded dot-dot-slash (../) sequences.

This issue may be exploited by a remote attacker to gain access to the administrative configuration file for the web server. Another known issue regarding plaintext storage of the administrative password is described in BugTraq ID 4467 "Abyss Web Server Plaintext Administrative Password Vulnerability" .

This issue was reported for Abyss Web Server for Microsoft Windows operating systems. It is not known whether the Linux version is also affected by this vulnerability. Furthermore, it should be noted that web servers on multi-user Windows operating systems generally run with SYSTEM privileges. 

http://target/cgi-bin/%2e%2e/abyss.conf