CVE-2008-7093 - Vulnerability Details - OpenCVE

Multiple directory traversal vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to (1) create arbitrary directories or files via a .. (dot dot) in the folder name in the new folder functionality or (2) list arbitrary files via a crafted request to Campaign/CampaignListener.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Unica	Affinium Campaign

Configuration 1 [-]

cpe:2.3:a:unica:affinium_campaign:7.2.1.0.55:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/31280
http://www.osvdb.org/47519
http://www.osvdb.org/47529
http://www.portcullis.co.uk/287.php
http://www.portcullis.co.uk/291.php
http://www.securityfocus.com/bid/30433
https://exchange.xforce.ibmcloud.com/vulnerabilities/44071
https://exchange.xforce.ibmcloud.com/vulnerabilities/44075

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-08-26T14:00:00

Updated: 2024-08-07T11:56:14.026Z

Reserved: 2009-08-26T00:00:00

Link: CVE-2008-7093

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-08-26T14:24:17.157

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-7093

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-07-30T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to (1) create arbitrary directories or files via a .. (dot dot) in the folder name in the new folder functionality or (2) list arbitrary files via a crafted request to Campaign/CampaignListener."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "affiniumcampaign-campaignlistener-info-disc(44075)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44075"}, {"tags": ["x_refsource_MISC"], "url": "http://www.portcullis.co.uk/287.php"}, {"name": "31280", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/31280"}, {"name": "30433", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/30433"}, {"name": "47529", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/47529"}, {"name": "47519", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/47519"}, {"name": "affiniumcampaign-folder-directory-traversal(44071)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44071"}, {"tags": ["x_refsource_MISC"], "url": "http://www.portcullis.co.uk/291.php"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-7093", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple directory traversal vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to (1) create arbitrary directories or files via a .. (dot dot) in the folder name in the new folder functionality or (2) list arbitrary files via a crafted request to Campaign/CampaignListener."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "affiniumcampaign-campaignlistener-info-disc(44075)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44075"}, {"name": "http://www.portcullis.co.uk/287.php", "refsource": "MISC", "url": "http://www.portcullis.co.uk/287.php"}, {"name": "31280", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/31280"}, {"name": "30433", "refsource": "BID", "url": "http://www.securityfocus.com/bid/30433"}, {"name": "47529", "refsource": "OSVDB", "url": "http://www.osvdb.org/47529"}, {"name": "47519", "refsource": "OSVDB", "url": "http://www.osvdb.org/47519"}, {"name": "affiniumcampaign-folder-directory-traversal(44071)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44071"}, {"name": "http://www.portcullis.co.uk/291.php", "refsource": "MISC", "url": "http://www.portcullis.co.uk/291.php"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T11:56:14.026Z"}, "title": "CVE Program Container", "references": [{"name": "affiniumcampaign-campaignlistener-info-disc(44075)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44075"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.portcullis.co.uk/287.php"}, {"name": "31280", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/31280"}, {"name": "30433", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/30433"}, {"name": "47529", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/47529"}, {"name": "47519", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/47519"}, {"name": "affiniumcampaign-folder-directory-traversal(44071)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44071"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.portcullis.co.uk/291.php"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-7093", "datePublished": "2009-08-26T14:00:00", "dateReserved": "2009-08-26T00:00:00", "dateUpdated": "2024-08-07T11:56:14.026Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:unica:affinium_campaign:7.2.1.0.55:*:*:*:*:*:*:*", "matchCriteriaId": "1989FF33-E3C4-466D-A721-D9C5327677CA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to (1) create arbitrary directories or files via a .. (dot dot) in the folder name in the new folder functionality or (2) list arbitrary files via a crafted request to Campaign/CampaignListener."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en Unica Affinium Campaign v7.2.1.0.55, permite a atacantes remotos (1) crear directorio o archivos de su elecci\u00f3n a trav\u00e9s de ..(punto punto) en el nombre de carpeta en la nueva funcionalidad \"new Folder\" o (2) listar archivos de su elecci\u00f3n a trav\u00e9s de peticiones manipuladas aCampaign/CampaignListener."}], "id": "CVE-2008-7093", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-08-26T14:24:17.157", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/31280"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/47519"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/47529"}, {"source": "cve@mitre.org", "url": "http://www.portcullis.co.uk/287.php"}, {"source": "cve@mitre.org", "url": "http://www.portcullis.co.uk/291.php"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/30433"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44071"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44075"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/31280"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/47519"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/47529"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.portcullis.co.uk/287.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.portcullis.co.uk/291.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/30433"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44071"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44075"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}