CVE-2001-0748

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Acme.Serve 1.7, as used in Cisco Secure ACS Unix and possibly other products, allows remote attackers to read arbitrary files by prepending several / (slash) characters to the URI.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.cisco.com/warp/public/707/acmeweb-acsunix-dirtravers-vuln-pub.shtmlThird Party Advisory
http://www.iss.net/security_center/static/6634.phpBroken Link
http://www.osvdb.org/5544Broken Link
http://www.securityfocus.com/archive/1/188141Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/2809Third Party Advisory, VDB Entry
http://www.cisco.com/warp/public/707/acmeweb-acsunix-dirtravers-vuln-pub.shtmlThird Party Advisory
http://www.iss.net/security_center/static/6634.phpBroken Link
http://www.osvdb.org/5544Broken Link
http://www.securityfocus.com/archive/1/188141Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/2809Third Party Advisory, VDB Entry

Timeline

Published: Oct 18, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-07497.5Beck IPC GmbH IPC@CHIP Embedded-Webserver allows remote attackers to read arbitrary files via a webserver root directory set to system root.CVE-2001-07505.0Cisco IOS 12.1(2)T, 12.1(3)T allow remote attackers to cause a denial of service (reload) via a connection to TCP ports 3100-3999, 5100-5999 CVE-2001-07517.5Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers (ISN), which allows remote attackers CVE-2001-07525.0Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via an ICMP ECHO REQUEST (ping) with the IP Record Route o CVE-2001-07537.5Cisco CBOS 2.3.8 and earlier stores the passwords for (1) exec and (2) enable in cleartext in the NVRAM and a configuration file, which coul CVE-2001-07545.0Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via a series of large ICMP ECHO REPLY (ping) packets, whic CVE-2001-07557.5Buffer overflow in ftp daemon (ftpd) 6.2 in Debian GNU/Linux allows attackers to cause a denial of service and possibly execute arbitrary co CVE-2001-07567.5CatalogMgr.pl in VirtualCatalog (incorrectly claimed to be in VirtualCart) allows remote attackers to execute arbitrary code via the templat CVE-2001-07577.5Cisco 6400 Access Concentrator Node Route Processor 2 (NRP2) 12.1DC card does not properly disable access when a password has not been set f CVE-2001-07587.5Directory traversal vulnerability in Shambala 4.5 allows remote attackers to escape the FTP root directory via "CWD ..." command.CVE-2001-07597.2Buffer overflow in bctool in Jetico BestCrypt 0.8.1 and earlier allows local users to execute arbitrary code via a file or directory with a CVE-2001-07605.0Citrix Nfuse 1.51 allows remote attackers to obtain the absolute path of the web root via a malformed request to launch.asp that does not pr