CVE-2001-1109

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in EFTP 2.0.7.337 allows remote authenticated users to reveal directory contents via a .. (dot dot) in the (1) LIST, (2) QUOTE SIZE, and (3) QUOTE MDTM commands.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.eftp.org/releasehistory.htmlURL Repurposed
http://www.securityfocus.com/archive/1/213647Vendor Advisory
http://www.securityfocus.com/bid/3331Vendor Advisory
http://www.securityfocus.com/bid/3333Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/7113
https://exchange.xforce.ibmcloud.com/vulnerabilities/7114
http://www.eftp.org/releasehistory.htmlURL Repurposed
http://www.securityfocus.com/archive/1/213647Vendor Advisory
http://www.securityfocus.com/bid/3331Vendor Advisory
http://www.securityfocus.com/bid/3333Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/7113
https://exchange.xforce.ibmcloud.com/vulnerabilities/7114

Timeline

Published: Sep 12, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-11105.0EFTP 2.0.7.337 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which c CVE-2001-11114.6EFTP 2.0.7.337 stores user passwords in plaintext in the eftp2users.dat file.CVE-2001-11127.5Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of ch CVE-2001-111310.0Buffer overflow in TrollFTPD 1.26 and earlier allows local users to execute arbitrary code by creating a series of deeply nested directories CVE-2001-11147.5book.cgi in NetCode NC Book 0.2b allows remote attackers to execute arbitrary commands via shell metacharacters in the "current" parameter.CVE-2001-11155.0generate.cgi in SIX-webboard 2.01 and before allows remote attackers to read arbitrary files via a dot dot (..) in the content parameter.CVE-2001-11164.6Identix BioLogon 2.03 and earlier does not lock secondary displays on a multi-monitor system running Windows 98 or ME, which allows an attac CVE-2001-11175.0LinkSys EtherFast BEFSR41 Cable/DSL routers running firmware before 1.39.3 Beta allows a remote attacker to view administration and user pas CVE-2001-11187.5A module in Roxen 2.0 before 2.0.92, and 2.1 before 2.1.264, does not properly decode UTF-8, Mac and ISO-2202 encoded URLs, which could allo CVE-2001-11196.2cda in xmcd 3.0.2 and 2.6 in SuSE Linux allows local users to overwrite arbitrary files via a symlink attack.CVE-2001-11206.4Vulnerabilities in ColdFusion 2.0 through 4.5.1 SP 2 allow remote attackers to (1) read or delete arbitrary files, or (2) overwrite ColdFusi CVE-2001-11222.1Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running th