Detections
Analytics

GuildFTPd Traversal Arbitrary File Enumeration

high Nessus Network Monitor Plugin ID 1840

Synopsis

The remote host may give an attacker information useful for future attacks.

Description

The remote FTP server (GuildFTPD) can be used to determine if a given file exists on the remote host by adding dot-dot-slashes in front of the filename.

Solution

Upgrade according to vendor recommendations.

See Also

http://aluigi.altervista.org/adv/guildftpd-dir-adv.txt

Plugin Details

Severity: High

ID: 1840

Family: FTP Servers

Published: 8/20/2004

Updated: 3/6/2019

Nessus ID: 10471

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:steve_poulsen:guildftpd

Reference Information

CVE: CVE-2000-0640

BID: 1452