CVE-2001-1432

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:C/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0085.htmlExploit
http://www.kb.cert.org/vuls/id/464827US Government Resource
http://www.securityfocus.com/bid/3772Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/7799
http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0085.htmlExploit
http://www.kb.cert.org/vuls/id/464827US Government Resource
http://www.securityfocus.com/bid/3772Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/7799

Timeline

Published: Dec 29, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-14337.5Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain CVE-2001-14345.0Cisco IOS 12.0(5)XU through 12.1(2) allows remote attackers to read system administration and topology information via an "snmp-server host"CVE-2001-14355.0inetd in Compaq Tru64 UNIX 5.1 allows attackers to cause a denial of service (network connection loss) by causing one of the services handle CVE-2001-14364.6Dallas Semiconductor iButton DS1991 returns predictable values when given an incorrect password, which makes it easier for users with physic CVE-2001-14377.5easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message CVE-2001-14385.0Handspring Visor 1.0 and 1.0.1 with the VisorPhone Springboard module installed allows remote attackers to cause a denial of service (PalmOS CVE-2001-14392.1Buffer overflow in the text editor functionality in HP-UX 10.01 through 11.04 on HP9000 Series 700 and Series 800 allows local users to caus CVE-2001-144010.0Unknown vulnerability in login for AIX 5.1L, when using loadable authentication modules, allows remote attackers to gain access to the syste CVE-2001-14416.8Cross-site scripting (XSS) vulnerability in VisualAge for Java 3.5 Professional allows remote attackers to execute JavaScript on other clien CVE-2001-14424.6Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the "news" group to gain privileges via a long -c c CVE-2001-14435.0KTH Kerberos IV and Kerberos V (Heimdal) for Telnet clients do not encrypt connections if the server does not support the requested encrypti CVE-2001-14447.5The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption opt