MS04-017: Crystal Reports Web Viewer Could Allow Information Disclosure and DoS (842689) (uncredentialed check)

high Nessus Plugin ID 12271

Language:

Synopsis

The web application running on the remote host has a directory traversal vulnerability.

Description

The remote host is running a version of Crystal Report Web interface that is vulnerable to a remote directory traversal attack. An attacker exploiting this issue would be able to read or delete arbitrary files outside of the web root.

Solution

Upgrade the software or utilize ACLs on the virtual directory.

Plugin Details

Severity: High

ID: 12271

File Name: crystal_reports_directory_traversal.nasl

Version: 1.33

Type: remote

Family: CGI abuses

Published: 6/11/2004

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:businessobjects:crystal_reports_server

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 6/8/2004

Reference Information

CVE: CVE-2004-0204

BID: 10260

MSFT: MS04-017

MSKB: 842689

Detections

Analytics