VULHUB ™

W3C's Amaya is a WYSIWYG web browser and authoring program. A complement package, the templates server, provides the ability to retrieve templates from an apache web server, for use in Amaya-based authoring. One of the scripts used by the Amaya template server, sendtemp.pl, is vulnerable to a simple directory traversal and file retrieval vulnerability. Using this script, an attacker can view contents of directories outside of the configured template directory, limited only by the restrictions on the apache web server process.

W3C's Amaya is a WYSIWYG web browser and authoring program. A complement package, the templates server, provides the ability to retrieve templates from an apache web server, for use in Amaya-based authoring. One of the scripts used by the Amaya template server, sendtemp.pl, is vulnerable to a simple directory traversal and file retrieval vulnerability. Using this script, an attacker can view contents of directories outside of the configured template directory, limited only by the restrictions on the apache web server process.