Description
BSCW groupware system 3.3 through 4.0.2 beta allows remote attackers to read or modify arbitrary files by uploading and extracting a tar file with a symlink into the data-bag space.
References
- bscw-extracted-file-symlink(7029) vdb-entry
- 20010822 BSCW symlink vulnerability mailing-list
- VU#465971 third-party-advisory
- http://bscw.gmd.de/Bulletins/BSCW-SB-2001-08.extract.txt
- 3227 vdb-entry