CWE
Home > CWE List > CWE-37 Individual Dictionary Definition (Draft 9)   View the CWE List

CWE-37 Individual Dictionary Definition (Draft 9)

Path Traversal: '/absolute/pathname/here'
Weakness ID
Status: Draft

37 (Weakness Variant)

Description

Summary

A software system that accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation can allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Potential Mitigations

see the vulnerability category "Path Traversal"

Observed Examples
ReferenceDescription
CVE-2002-1345Multiple FTP clients write arbitrary files via absolute paths in server responses
CVE-2001-1269ZIP file extractor allows full path
CVE-2002-1818Path traversal using absolute pathname
CVE-2002-1913Path traversal using absolute pathname
CVE-2005-2147Path traversal using absolute pathname
Relationships
NatureTypeIDName
ChildOfWeakness BaseWeakness BaseWeakness Base36Absolute Path Traversal
Source Taxonomies

PLOVER - /absolute/pathname/here

Applicable Platforms

All

Back to top
Page Last Updated: April 22, 2008
 

CWE is sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us