CVE-2001-0973

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

BSCW groupware system 3.3 through 4.0.2 beta allows remote attackers to read or modify arbitrary files by uploading and extracting a tar file with a symlink into the data-bag space.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2001-08/0328.htmlPatch, Vendor Advisory
http://bscw.gmd.de/Bulletins/BSCW-SB-2001-08.extract.txtPatch, Vendor Advisory
http://www.iss.net/security_center/static/7029.php
http://www.kb.cert.org/vuls/id/465971US Government Resource
http://www.securityfocus.com/bid/3227
http://archives.neohapsis.com/archives/bugtraq/2001-08/0328.htmlPatch, Vendor Advisory
http://bscw.gmd.de/Bulletins/BSCW-SB-2001-08.extract.txtPatch, Vendor Advisory
http://www.iss.net/security_center/static/7029.php
http://www.kb.cert.org/vuls/id/465971US Government Resource
http://www.securityfocus.com/bid/3227

Timeline

Published: Aug 31, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-09747.5Format string vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary code,CVE-2001-09757.5Buffer overflow vulnerabilities in Oracle Internet Directory Server (LDAP) 2.1.1.x and 3.0.1 allow remote attackers to execute arbitrary cod CVE-2001-09767.2Vulnerability in HP Process Resource Manager (PRM) C.01.08.2 and earlier, as used by HP-UX Workload Manager (WLM), allows local users to gai CVE-2001-09775.0slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic CVE-2001-09787.5login in HP-UX 10.26 does not record failed login attempts in /var/adm/btmp, which could allow attackers to conduct brute force password gue CVE-2001-09797.2Buffer overflow in swverify in HP-UX 11.0, and possibly other programs, allows local users to gain privileges via a long command line argume CVE-2001-09807.5docview before 1.0-15 allows remote attackers to execute arbitrary commands via shell metacharacters that are processed when converting a ma CVE-2001-098110.0HP CIFS/9000 Server (SAMBA) A.01.07 and earlier with the "unix password sync" option enabled calls the passwd program without specifying the CVE-2001-09825.0Directory traversal vulnerability in IBM Tivoli WebSEAL Policy Director 3.01 through 3.7.1 allows remote attackers to read arbitrary files o CVE-2001-09834.6UltraEdit uses weak encryption to record FTP passwords in the uedit32.ini file, which allows local users who can read the file to decrypt th CVE-2001-09844.6Password Safe 1.7(1) leaves cleartext passwords in memory when a user copies the password to the clipboard and minimizes Password Safe with CVE-2001-09857.5shop.pl in Hassan Consulting Shopping Cart 1.23 allows remote attackers to execute arbitrary commands via shell metacharacters in the "page"