Detections
Analytics

Novell NetBasic Scripting Server Encoded Traversal Arbitrary File Access

medium Nessus Plugin ID 12050

Language:

Synopsis

The remote host is vulnerable to information disclosure.

Description

Novell Netbasic Scripting Server Directory Traversal

It is possible to escape out of the root directory of the scripting server by substituting a forward or backward slash for %5C. As a result, system information, such as environment and user information, could be obtained from the NetWare server.

Example: http://server/nsn/..%5Cutil/userlist.bas

Solution

Apply the relevant patch and remove all default files from their respective directories.

Plugin Details

Severity: Medium

ID: 12050

File Name: novell_netbasic_directory_traversal.nasl

Version: 1.19

Type: remote

Family: Netware

Published: 2/9/2004

Updated: 6/12/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/13/2002

Vulnerability Publication Date: 8/20/2002

Reference Information

CVE: CVE-2002-1417

BID: 5523