V
Scaner-VS
ENRU
HomeCatalogSourcesCWECAPECATT&CKMitigationsProductsVendorsDocs
←Back to catalog
CVE-2004-0204
CVE
HighConfirmedExploit available

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used…

CVSS
7.5
High
EPSS
0.73
p99
Published
2004-01-01
Updated
2004-01-01
Description

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.

Affected products
Weblogic_serverJ_builderCrystal_enterpriseCrystal_enterprise_java_sdkCrystal_enterprise_rasCrystal_reportsBusiness_solutions_crmOutlookVisual_studio_.net
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Timeline
2004-01-01
Published
2004-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Authentication
Au: N
None (N)
Confidentiality Impact
C: P
Partial
Integrity Impact
I: P
Partial
Availability Impact
A: P
Partial
Exploit indicators
EPSS
0.730 · p99
Known exploited (KEV)
No
Known exploits — Сканер-ВС
24077
exploitdb · https://www.exploit-db.com/exploits/24077
Enterprise
Affected products
Microsoft
OutlookVisual Studio .netBusiness Solutions Crm
Bea
Weblogic Server
Borland_software
J Builder
Businessobjects
Crystal EnterpriseCrystal ReportsCrystal Enterprise Java SdkCrystal Enterprise Ras
ProductVendorStatus
business_solutions_crm*Tracked
crystal_enterprise*Tracked
crystal_enterprise_java_sdk*Tracked
crystal_enterprise_ras*Tracked
crystal_reports*Tracked
j_builder*Tracked
outlook*Tracked
visual_studio_.net*Tracked
weblogic_server*Tracked
Source databases
CVE