CVE-2001-0038
published 2001-02-16CVE-2001-0038: Offline Explorer 1.4 before Service Release 2 allows remote attackers to read arbitrary files by specifying the drive letter (e.g. C:) in the requested URL.
PriorityP421medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
3.33%
87.1th percentile
Offline Explorer 1.4 before Service Release 2 allows remote attackers to read arbitrary files by specifying the drive letter (e.g. C:) in the requested URL.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| metaproducts | offline_explorer | — | — |
| metaproducts | offline_explorer | — | — |
| metaproducts | offline_explorer | — | — |
| metaproducts | offline_explorer | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
CWE
Absolute Path Traversal
mitre_cwe
CWE-36 Absolute Path Traversal
CWE-36: Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality, Availability. Impact: Execute Unauthorized Code or Commands. The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Scope: Integrity. Impact: Modify Files or Directories. The attacker may be able to overwrite or create
CWE
Path Traversal: 'C:dirname'
mitre_cwe
CWE-39 Path Traversal: 'C:dirname'
CWE-39: Path Traversal: 'C:dirname'
The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially redirects access to an unintended location or arbitrary file.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality, Availability. Impact: Execute Unauthorized Code or Commands. The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Scope: Integrity. Impact: Modify Files or Directories. The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending
http://archives.neohapsis.com/archives/bugtraq/2000-12/0078.htmlhttp://www.securityfocus.com/bid/2084https://exchange.xforce.ibmcloud.com/vulnerabilities/5728http://archives.neohapsis.com/archives/bugtraq/2000-12/0078.htmlhttp://www.securityfocus.com/bid/2084https://exchange.xforce.ibmcloud.com/vulnerabilities/5728
2001-02-16
Published