Path Equivalence: 'filename ' (Trailing Space)

Opis

The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Skutki

• Confidentiality, Integrity

  Read Files or Directories; Modify Files or Directories

Przykłady podatności

• CVE-2001-0693 Source disclosure via trailing encoded space "%20"
• CVE-2001-0778 Source disclosure via trailing encoded space "%20"
• CVE-2001-1248 Source disclosure via trailing encoded space "%20"
• CVE-2004-0280 Source disclosure via trailing encoded space "%20"
• CVE-2004-2213 Source disclosure via trailing encoded space "%20"
• CVE-2005-0622 Source disclosure via trailing encoded space "%20"
• CVE-2005-1656 Source disclosure via trailing encoded space "%20"
• CVE-2002-1603 Source disclosure via trailing encoded space "%20"
• CVE-2001-0054 Multi-Factor Vulnerability (MFV). directory traversal and other issues in FTP server using Web encodings such as "%20"; certain manipulations have unusual side effects.
• CVE-2002-1451 Trailing space ("+" in query string) leads to source code disclosure.

Słabość nadrzędna

• CWE-41 Improper Resolution of Path Equivalence
• CWE-162 Improper Neutralization of Trailing Special Elements

Może prowadzić do

• CWE-289 Authentication Bypass by Alternate Name

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific, Web Based