VULHUB ™

A remote user is capable of gaining read access to any known file residing on a host running Netwin Netauth through directory traversal. Appending a series of '../' and the desired file name to the 'page' variable at the end of a request to netauth.cgi will allow a remote user to walk the entire directory tree above the Netauth directory. For example: http://target/cgi-bin/netauth.cgi?cmd=show&page=../../directory will display the contents of the specified directory.

A remote user is capable of gaining read access to any known file residing on a host running Netwin Netauth through directory traversal. Appending a series of '../' and the desired file name to the 'page' variable at the end of a request to netauth.cgi will allow a remote user to walk the entire directory tree above the Netauth directory. For example: http://target/cgi-bin/netauth.cgi?cmd=show&page=../../directory will display the contents of the specified directory.