Vulnerabilities > CVE-2002-1861 - Unspecified vulnerability in Sybase Easerver 4.0

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
sybase
nessus
NVD
Published: 2002-12-31
Updated: 2008-09-05

Summary

Sybase Enterprise Application Server 4.0, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").

Vulnerable Configurations

Part Description Count
Application
Sybase
1

Nessus

NASL familyCGI abuses
NASL idGENERIC_WEB-INF.NASL
descriptionBy making a specially-formatted request to the remote web server, it is possible to retrieve files located under the
last seen2020-06-01
modified2020-06-02
plugin id11037
published2002-07-01
reporterThis script is Copyright (C) 2002-2018 Matt Moore
sourcehttps://www.tenable.com/plugins/nessus/11037
titleMultiple Server Crafted Request WEB-INF Directory Information Disclosure

References