CVE-2008-5275

Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or (2) ZIP archive.  NOTE: this can be leveraged for code execution by creating a .php file.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
VendorProductVersion
net2ftpnet2ftp
0.96:stable
net2ftpnet2ftp
0.97:beta
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/30611
http://vuln.sg/net2ftp096-en.html
http://www.securityfocus.com/bid/29664
https://exchange.xforce.ibmcloud.com/vulnerabilities/42994
http://secunia.com/advisories/30611
http://vuln.sg/net2ftp096-en.html
http://www.securityfocus.com/bid/29664
https://exchange.xforce.ibmcloud.com/vulnerabilities/42994