CVE-2013-3739
published 2014-06-05CVE-2013-3739: Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in…
PriorityP269medium5CVSS 2.0
AVNACLAuNCPINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.68%
88.3th percentile
Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the mapname parameter in a show_config action.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| network-weathermap | network_weathermap | <= 0.97 | — |
| network-weathermap | network_weathermap | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttp://server/editor.php?action=show_config&mapname=../../../../../../../../../etc/apache2/apache2.conf↗
- →Detect HTTP requests to editor.php with 'action=show_config' and a 'mapname' parameter containing directory traversal sequences (../). ↗
- →Monitor for requests to editor.php where the mapname parameter contains dot-dot sequences to traverse outside the web root, particularly targeting sensitive files such as /etc/apache2/apache2.conf. ↗
- →Alert on the presence of editor.php being accessible/enabled on the web server, as exploitation requires it to be enabled. ↗
- →Watch for file read attempts on non-.config files via the mapname parameter, as the .config restriction filter can be bypassed using a PHP bug. ↗
- ·The vulnerability only affects instances where editor.php is enabled and accessible; disabling it is a temporary mitigation. ↗
- ·The .config file extension restriction in the mapname parameter can be bypassed via a PHP bug, allowing inclusion of arbitrary file types readable by the web server (including PHP source files, which are read rather than executed). ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x45c-ccr5-vr7f: Directory traversal vulnerability in editor
ghsa_unreviewed·2022-05-17
CVE-2013-3739 [MEDIUM] CWE-22 GHSA-x45c-ccr5-vr7f: Directory traversal vulnerability in editor
Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the mapname parameter in a show_config action.
VulnCheck
network-weathermap .network_weathermap Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2013·CVSS 5.0
CVE-2013-3739 [MEDIUM] network-weathermap .network_weathermap Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
network-weathermap .network_weathermap Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the mapname parameter in a show_config action.
Affected: network-weathermap .network_weathermap
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-
No detection rules found.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2013-06/0035.htmlhttp://osvdb.org/94078http://www.exploit-db.com/exploits/26125http://www.securityfocus.com/bid/60434http://archives.neohapsis.com/archives/bugtraq/2013-06/0035.htmlhttp://osvdb.org/94078http://www.exploit-db.com/exploits/26125http://www.securityfocus.com/bid/60434
2014-06-05
Published
Exploited in the wild