CVE-2010-3842
Severity Score
5.8
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
Vulnerabilidad de salto de directorio absoluto en curl v7.20.0 hasta v7.21.1, cuando se utiliza la opción --remote-header-name o -J, permite a los servidores remotos crear o sobreescribir archivos arbitrarios mediante el uso de \ (barra invertida) como un separador de componentes de la ruta dentro de la cabecera HTTP Content-disposition.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2010-10-08 CVE Reserved
- 2010-10-27 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://securitytracker.com/id?1024583 | Vdb Entry | |
| http://www.openwall.com/lists/oss-security/2010/10/13/1 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2010/10/13/5 | Mailing List |
|
| https://bugzilla.redhat.com/show_bug.cgi?id=642642 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2010/10/13/4 | 2010-10-28 |
| URL | Date | SRC |
|---|---|---|
| http://curl.haxx.se/docs/adv_20101013.html | 2010-10-28 | |
| http://secunia.com/advisories/39532 | 2010-10-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Curl Search vendor "Curl" | Curl Search vendor "Curl" for product "Curl" | 7.20.0 Search vendor "Curl" for product "Curl" and version "7.20.0" | - |
Affected
| ||||||
| Curl Search vendor "Curl" | Curl Search vendor "Curl" for product "Curl" | 7.20.1 Search vendor "Curl" for product "Curl" and version "7.20.1" | - |
Affected
| ||||||
| Curl Search vendor "Curl" | Curl Search vendor "Curl" for product "Curl" | 7.21.1 Search vendor "Curl" for product "Curl" and version "7.21.1" | - |
Affected
| ||||||