CVE-2008-3363 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the include parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dokeos	E-learning System

Configuration 1 [-]

cpe:2.3:a:dokeos:e-learning_system:1.8.5:*:windows:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/30987
http://securityreason.com/securityalert/4056
http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5
http://www.securityfocus.com/archive/1/494496/100/0/threaded
http://www.securityfocus.com/bid/30150
http://www.vupen.com/english/advisories/2008/2208/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/43865
https://www.exploit-db.com/exploits/6149

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-07-30T16:03:00

Updated: 2024-08-07T09:37:26.550Z

Reserved: 2008-07-30T00:00:00

Link: CVE-2008-3363

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-07-30T16:41:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-3363

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-07-17T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote attackers to include and execute arbitrary local files via a ..\\ (dot dot backslash) in the include parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "6149", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/6149"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5"}, {"name": "ADV-2008-2208", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/2208/references"}, {"name": "20080717 [DSECRG-08-029] Local File Include in Dokeos E-Learning System 1.8.5", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/494496/100/0/threaded"}, {"name": "dokeos-userportal-file-include(43865)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43865"}, {"name": "30987", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/30987"}, {"name": "4056", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/4056"}, {"name": "30150", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/30150"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-3363", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote attackers to include and execute arbitrary local files via a ..\\ (dot dot backslash) in the include parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "6149", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/6149"}, {"name": "http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5", "refsource": "CONFIRM", "url": "http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5"}, {"name": "ADV-2008-2208", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/2208/references"}, {"name": "20080717 [DSECRG-08-029] Local File Include in Dokeos E-Learning System 1.8.5", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/494496/100/0/threaded"}, {"name": "dokeos-userportal-file-include(43865)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43865"}, {"name": "30987", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/30987"}, {"name": "4056", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/4056"}, {"name": "30150", "refsource": "BID", "url": "http://www.securityfocus.com/bid/30150"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T09:37:26.550Z"}, "title": "CVE Program Container", "references": [{"name": "6149", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/6149"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5"}, {"name": "ADV-2008-2208", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/2208/references"}, {"name": "20080717 [DSECRG-08-029] Local File Include in Dokeos E-Learning System 1.8.5", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/494496/100/0/threaded"}, {"name": "dokeos-userportal-file-include(43865)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43865"}, {"name": "30987", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/30987"}, {"name": "4056", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/4056"}, {"name": "30150", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/30150"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-3363", "datePublished": "2008-07-30T16:03:00", "dateReserved": "2008-07-30T00:00:00", "dateUpdated": "2024-08-07T09:37:26.550Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dokeos:e-learning_system:1.8.5:*:windows:*:*:*:*:*", "matchCriteriaId": "EF7C7647-A10E-458B-BD56-264CAF0D9660", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in user_portal.php in the Dokeos E-Learning System 1.8.5 on Windows allows remote attackers to include and execute arbitrary local files via a ..\\ (dot dot backslash) in the include parameter."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en user_portal.php en the Dokeos E-Learning System 1.8.5 sobre Windows, permite a atacantes remotos incluir y ejecutar archivos locales de su elecci\u00f3n a trav\u00e9s de \"..\\\" (punto punto barra invertida) en el par\u00e1metro \"include\"."}], "id": "CVE-2008-3363", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-07-30T16:41:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/30987"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/4056"}, {"source": "cve@mitre.org", "url": "http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/494496/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/30150"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/2208/references"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43865"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/6149"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/30987"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/4056"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/494496/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/30150"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/2208/references"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43865"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/6149"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}