CVE-2002-1837

The getAlbumToDisplay function in idsShared.pm for Image Display System (IDS) 0.81 allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album parameter, which generates different error messages depending on whether the directory exists or not.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

2.94% chance of exploitation in the next 30 days, 86th percentile

Published

2005-06-28

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/21487

References

• CVE Record
• NVD entry

Related

• CVE-2002-1831
• CVE-2002-1845
• CVE-2002-1830
• CVE-2002-1847
• CVE-2002-1829
• CVE-2002-1850