Vulnerability Name:

CVE-2000-1048 (CCN-5373)

Assigned:2000-10-16
Published:2000-10-16
Updated:2017-12-19
Summary:Directory traversal vulnerability in the logfile service of Wingate 4.1 Beta A and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack via an HTTP GET request that uses encoded characters in the URL.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: BUGTRAQ
Type: Vendor Advisory
20001016 Wingate 4.1 Beta A vulnerability

Source: MITRE
Type: CNA
CVE-2000-1048

Source: CCN
Type: Blue Panda Vulnerability Announcement
Wingate 4.1 Beta A arbitrary file download vulnerability

Source: CCN
Type: WinGate 4.1 Beta C
WinGate

Source: CCN
Type: OSVDB ID: 7696
WinGate logfile Service Traversal Arbitrary File Download

Source: XF
Type: UNKNOWN
wingate-view-files(5373)

Source: XF
Type: UNKNOWN
wingate-view-files(5373)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:qbik:wingate:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:qbik:wingate:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:qbik:wingate:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:qbik:wingate:4.1_beta_a:*:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:qbik:wingate:4.1:beta_a:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    qbik wingate 2.1
    qbik wingate 3.0
    qbik wingate 4.0.1
    qbik wingate 4.1_beta_a
    qbik wingate 4.1 beta_a