vulnwire
7.8high

CVE-2008-03961 exploit

Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileserve…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.5%
percentile 95%
Public exploits
1
Exploit-DB

Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileservers and Enterprise Manager (BDEM), allows remote attackers to read arbitrary files via .. (dot dot) sequences in an HTTP request.

Exploit prediction (EPSS)

8.53% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

  • EDB-31039 BitDefender Products - Update Server HTTP Daemon Directory Traversal · remote · 2008-01-19

CVSS scores

Assigned byVersionScoreVector
NVD2.07.8AV:N/AC:L/Au:N/C:C/I:N/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • securityfocus.com /bid/27358 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /archive/1/486701/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/39802 · vdb-entry, x_refsource_XF, x_transferred
  • securityreason.com /securityalert/3568 · third-party-advisory, x_refsource_SREASON, x_transferred
  • oliver.greyhat.de /2008/01/19/bitdefender-unauthorized-remote-file-access-vulnerability/ · x_refsource_MISC, x_transferred
  • secunia.com /advisories/28578 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/0213 · vdb-entry, x_refsource_VUPEN, x_transferred
  • oliverkarow.de /research/bitdefender.txt · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.