JVNDB-2010-000003

WebCalenderC3 vulnerable to directory traversal

WebCalenderC3 from C3 Corp. contains a directory traversal vulnerability.

WebCalenderC3 from C3 Corp. is a calender software. WebCalenderC3 contains a directory traversal vulnerability.

Masako Oono reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 5.0 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: None
• Availability Impact: None

C3

• WebCalenderC3 V0.32 and earlier

A remote attacker could view an arbitrary file on the server.

[Update the Software]
Update to the latest version according to the information provided by the developer.

C3

• WebCalenderC3 : WebCalenderC3 (Japanese)

1. JVN : JVN#22247093
2. National Vulnerability Database (NVD) : CVE-2010-0348
3. Common Vulnerabilities and Exposures (CVE) : CVE-2010-0348
4. Secunia Advisory : SA38135
5. OPEN SOURCE VULNERABILITY DATABASE (OSVDB) : 61630
6. Common Weakness Enumeration (CWE) : Path Traversal (CWE-22) [IPA Evaluation]

[2010/01/14]
  Web page published