Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://marc.info/?l=bugtraq&m=108360413811017&w=2 | mailing-list x_refsource_BUGTRAQ |
| http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp | x_refsource_CONFIRM |
| http://secunia.com/advisories/11800 | third-party-advisory x_refsource_SECUNIA |
| http://marc.info/?l=bugtraq&m=108671836127360&w=2 | mailing-list x_refsource_BUGTRAQ |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16044 | vdb-entry x_refsource_XF |
| http://www.osvdb.org/6748 | vdb-entry x_refsource_OSVDB |
| http://www.securityfocus.com/bid/10260 | vdb-entry x_refsource_BID |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157 | vdb-entry signature x_refsource_OVAL |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017 | vendor-advisory x_refsource_MS |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://marc.info/?l=bugtraq&m=108360413811017&w=2 | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://support.businessobjects.com/fix/hot/critical/bulletins/security_bulletin_june04.asp | x_refsource_CONFIRM x_transferred |
| http://secunia.com/advisories/11800 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://marc.info/?l=bugtraq&m=108671836127360&w=2 | mailing-list x_refsource_BUGTRAQ x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16044 | vdb-entry x_refsource_XF x_transferred |
| http://www.osvdb.org/6748 | vdb-entry x_refsource_OSVDB x_transferred |
| http://www.securityfocus.com/bid/10260 | vdb-entry x_refsource_BID x_transferred |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1157 | vdb-entry signature x_refsource_OVAL x_transferred |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-017 | vendor-advisory x_refsource_MS x_transferred |