CVE-2004-1505 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Salims Softhouse	Jaf Cms

Configuration 1 [-]

cpe:2.3:a:salims_softhouse:jaf_cms:3.0:rc:*:*:*:*:*:*

No data.

References

Link	Providers
http://echo.or.id/adv/adv08-y3dips-2004.txt
http://marc.info/?l=bugtraq&m=110004150430309&w=2
http://secunia.com/advisories/13104
http://www.securityfocus.com/bid/11627
https://exchange.xforce.ibmcloud.com/vulnerabilities/17983

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2005-02-19T05:00:00

Updated: 2024-08-08T00:53:23.955Z

Reserved: 2005-02-18T00:00:00

Link: CVE-2004-1505

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2004-12-31T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2004-1505

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2004-11-09T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "13104", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/13104"}, {"name": "11627", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/11627"}, {"name": "jaf-cms-file-inlcude(17983)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17983"}, {"tags": ["x_refsource_MISC"], "url": "http://echo.or.id/adv/adv08-y3dips-2004.txt"}, {"name": "20041109 Vulnerabilities in JAF CMS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=110004150430309&w=2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2004-1505", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "13104", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/13104"}, {"name": "11627", "refsource": "BID", "url": "http://www.securityfocus.com/bid/11627"}, {"name": "jaf-cms-file-inlcude(17983)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17983"}, {"name": "http://echo.or.id/adv/adv08-y3dips-2004.txt", "refsource": "MISC", "url": "http://echo.or.id/adv/adv08-y3dips-2004.txt"}, {"name": "20041109 Vulnerabilities in JAF CMS", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=110004150430309&w=2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T00:53:23.955Z"}, "title": "CVE Program Container", "references": [{"name": "13104", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/13104"}, {"name": "11627", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/11627"}, {"name": "jaf-cms-file-inlcude(17983)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17983"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://echo.or.id/adv/adv08-y3dips-2004.txt"}, {"name": "20041109 Vulnerabilities in JAF CMS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=110004150430309&w=2"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2004-1505", "datePublished": "2005-02-19T05:00:00", "dateReserved": "2005-02-18T00:00:00", "dateUpdated": "2024-08-08T00:53:23.955Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:salims_softhouse:jaf_cms:3.0:rc:*:*:*:*:*:*", "matchCriteriaId": "0FDEF8C5-7AD0-460B-9DE0-86776EA856F4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter."}], "id": "CVE-2004-1505", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2004-12-31T05:00:00.000", "references": [{"source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"], "url": "http://echo.or.id/adv/adv08-y3dips-2004.txt"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=110004150430309&w=2"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/13104"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/11627"}, {"source": "[email protected]", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://echo.or.id/adv/adv08-y3dips-2004.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=110004150430309&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/13104"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/11627"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17983"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}