CVE-2010-2079

DataTrack System 3.5 allows remote attackers to bypass intended restrictions on file extensions, and read arbitrary files, via a trailing backslash in a URI, as demonstrated by (1) web.config\ and (2) .ascx\ files.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2010-05-25

Last modified

2024-08-07

Weaknesses

CWE-20

Affected products

• Datatrack System (Magnoware)

References

• http://cross-site-scripting.blogspot.com/2010/05/datatrack-system-35-persistent-xss.html
• http://packetstormsecurity.org/1005-exploits/datatrackserver35-xss.txt
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58735