Progress WebSpeed Unauthorized Access Vulnerability

vendor:

Progress WebSpeed

by:

SecurityFocus

7.5

CVSS

HIGH

Unauthorized Access

287

CWE

Product Name: Progress WebSpeed

Affected Version From: 3.1a

Affected Version To: 3.1e

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Progress WebSpeed Unauthorized Access Vulnerability

Progress WebSpeed is prone to a vulnerability that lets attackers gain unauthorized access to and execute administrative scripts. An attacker may leverage this issue to create and execute malicious WebSpeed code on the host running the webserver. Such unauthorized access may help the attacker launch other attacks. WebSpeed 3.1a, 3.1d, and 3.1e are vulnerable; other versions may also be affected.

Mitigation:

Ensure that the 'Development Mode' of the application is not used in production systems and that the 'TTY' directory is not installed.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/23634/info

Progress WebSpeed is prone to a vulnerability that lets attackers gain unauthorized access to and execute administrative scripts.

An attacker may leverage this issue to create and execute malicious WebSpeed code on the host running the webserver. Such unauthorized access may help the attacker launch other attacks.

WebSpeed 3.1a, 3.1d, and 3.1e are vulnerable; other versions may also be affected.

NOTE: Further reports suggest that this issue affects only the 'Development Mode' of the application. This mode is not intended to be used in production systems. This issue is also present when the 'tty' directory is installed. 

http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fil
eName=C:/root.txt&action=last&section=1&txt0=Test