Description
Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted Host header.
References
- 47908 third-party-advisory
- 20120203 Mathopd - Directory Traversal Vulnerability mailing-list
- [mathopd] 20120202 security alert: directory traversal when using * in Location mailing-list
- 1026641 vdb-entry
- mathopd-http-directory-traversal(73049) vdb-entry
- http://www.mathopd.org/security.html
- 78896 vdb-entry