Description
The Administration console for Abyss Web Server 1.0.3 allows remote attackers to read files without providing login credentials via an HTTP request to a target file that ends in a "+" character.
References
- http://www.aprelium.com/news/patch1033.html
- 20020822 Abyss 1.0.3 directory traversal and administration bugs mailing-list
- 3286 vdb-entry
- 5549 vdb-entry
- abyss-plus-file-disclosure(9956) vdb-entry