$ cve CVE-2008-1606 JSON

CVE-2008-1606 EXPLOIT

6.0

MEDIUM · CVSS 2.0 · EPSS 2.1% (pctl 81)

Patch early

A public exploit exists.

Description

Multiple directory traversal vulnerabilities in Elastic Path (EP) 4.1 and 4.1.1 allow remote attackers to (1) download arbitrary files via a .. (dot dot) in the file parameter to manager/getImportFileRedirect.jsp, (2) upload arbitrary files via a "..\" (dot dot backslash) in the file parameter to importData.jsp, and (3) list directory contents via a .. (dot dot) in the dir parameter to manager/fileManager.jsp.

Scoring

CVSS	6.0 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS	2.14% — more likely to be exploited than 81% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2008-04-01
Last modified	2026-06-16

Affected (1)

Vendor	Product
elastic path	elastic path

Public exploits

Source	Title	Date
exploit-db	Elastic Path 4.1 - '/manager/getImportFileRedirect.jsp?file' Traversal Arbitrary File Access	2008-03-20
exploit-db	Elastic Path 4.1 - '/manager/FileManager.jsp?dir' Traversal Arbitrary Directory Listing	2008-03-20

References

→ the Explorer · watch your stack · NVD