header-logo
Suggest Exploit
vendor:
IDS Device Manager
by:
SecurityFocus
8.3
CVSS
HIGH
Directory Traversal
22
CWE
Product Name: IDS Device Manager
Affected Version From: 1
Affected Version To: 1
Patch Exists: YES
Related CWE: CVE-2002-0607
CPE: a:cisco:ids_device_manager
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2002

IDS Device Manager Directory Traversal

IDS Device Manager is a web interface to the Cisco IDS systems. It is distributed and maintained by Cisco Systems. Due to improper handling of user-supplied input, it is possible for a user to gain access to arbitrary files on the system using an elementary directory traversal attack. By placing a request to the process, with an appended dot-dot-slash (../) tag pointing to a file, a remote user may read the specified file on the affected system.

Mitigation:

Upgrade to the latest version of IDS Device Manager.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4760/info

IDS Device Manager is a web interface to the Cisco IDS systems. It is distributed and maintained by Cisco Systems.

The IDS Device Manager may allow a remote user to gain access to sensitive information on the system. Due to improper handling of user-supplied input, it is possible for a user to gain access to arbitrary files on the system using an elementary directory traversal attack. By placing a request to the process, with an appended dot-dot-slash (../) tag pointing to a file, a remote user may read the specified file on the affected system. 

https://example.com/../../../../../etc/shadow

Navigation

Suggest Exploit

Services By CQR