CVE-2007-2440

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. (dot dot) in a URI containing a "\web-inf" sequence.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/36058
http://secunia.com/advisories/25286Patch, Vendor Advisory
http://www.caucho.com/resin-3.1/changes/changes.xtp
http://www.rapid7.com/advisories/R7-0029.jspPatch, Vendor Advisory
http://www.securityfocus.com/bid/23985Exploit, Patch
http://www.securitytracker.com/id?1018061
http://www.vupen.com/english/advisories/2007/1824
https://exchange.xforce.ibmcloud.com/vulnerabilities/34296
http://osvdb.org/36058
http://secunia.com/advisories/25286Patch, Vendor Advisory
http://www.caucho.com/resin-3.1/changes/changes.xtp
http://www.rapid7.com/advisories/R7-0029.jspPatch, Vendor Advisory
http://www.securityfocus.com/bid/23985Exploit, Patch
http://www.securitytracker.com/id?1018061
http://www.vupen.com/english/advisories/2007/1824
https://exchange.xforce.ibmcloud.com/vulnerabilities/34296

Timeline

Published: May 16, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-24415.0Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certain CVE-2007-244210.0The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute ar CVE-2007-24438.3Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earli CVE-2007-24447.2Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privi CVE-2007-24455.0The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of serv CVE-2007-244610.0Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary CVE-2007-24476.0The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharac CVE-2007-24482.1Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not c CVE-2007-24494.3Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.CVE-2007-24503.5Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through CVE-2007-24515.0Unspecified vulnerability in drivers/crypto/geode-aes.c in GEODE-AES in the Linux kernel before 2.6.21.3 allows attackers to obtain sensitiv CVE-2007-24526.0Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-