vendor:
StarOffice
by:
SecurityFocus
7.5
CVSS
HIGH
Path Traversal
22
CWE
Product Name: StarOffice
Affected Version From: StarOffice 5.2
Affected Version To: StarOffice 5.2
Patch Exists: No
Related CWE: N/A
CPE: a:sun_microsystems:staroffice:5.2
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
StarOffice StarScheduler Path Traversal Vulnerability
StarOffice is a desktop office suite offered by Sun Microsystems. StarScheduler is a groupware server that ships with StarOffice and includes a webserver that runs as root by default. When a request it sent to a webserver for a document, the StarScheduler httpd will follow "../" paths if provided. As a result, exploiting this allows an attacker to view any file on the target system (the server runs as root..), including files such as /etc/shadow.
Mitigation:
Disable the StarScheduler webserver or restrict access to it.
