CVE-2008-1652

Directory traversal vulnerability in the _serve_request_multiple function in lib/Perlbal/ClientHTTPBase.pm in Perlbal before 1.70, when concat get is enabled, allows remote attackers to read arbitrary files in a parent directory via a directory traversal sequence in an unspecified parameter.  NOTE: some of these details are obtained from third party information.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
perlbalperlbal
𝑥
≤ 1.60
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
perlbal
bullseye
1.80-3.1
fixed
sid
1.80-4
fixed
trixie
1.80-4
fixed
bookworm
1.80-4
fixed
Common Weakness Enumeration
References
http://search.cpan.org/src/BRADFITZ/Perlbal-1.70/CHANGES
http://secunia.com/advisories/29565
http://www.vupen.com/english/advisories/2008/1045/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41540
http://search.cpan.org/src/BRADFITZ/Perlbal-1.70/CHANGES
http://secunia.com/advisories/29565
http://www.vupen.com/english/advisories/2008/1045/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41540