91
Reference Description
https://www.cve.org/CVERecord?id=CVE-2004-0235
CVE-2002-1078 Directory listings in web server using multiple trailing slash
https://www.cve.org/CVERecord?id=CVE-2002-1078
CVE-2004-0847 ASP.NET allows remote attackers to bypass authentication for .aspx files
in restricted directories via a request containing a (1) "\" (backslash) or (2)
"%5C" (encoded backslash), aka "Path Validation Vulnerability."
https://www.cve.org/CVERecord?id=CVE-2004-0847
CVE-2000-0004 Server allows remote attackers to read source code for executable files by
inserting a . (dot) into the URL.
https://www.cve.org/CVERecord?id=CVE-2000-0004
CVE-2002-0304 Server allows remote attackers to read password-protected files via a /./ in the
HTTP request.
https://www.cve.org/CVERecord?id=CVE-2002-0304
CVE-1999-1083 Possibly (could be a cleansing error)
https://www.cve.org/CVERecord?id=CVE-1999-1083
CVE-2004-0815 "/./////etc" cleansed to ".///etc" then "/etc"
https://www.cve.org/CVERecord?id=CVE-2004-0815
CVE-2002-0112 Server allows remote attackers to view password protected files via /./ in the
URL.
https://www.cve.org/CVERecord?id=CVE-2002-0112
CVE-2004-0696 List directories using desired path and "*"
https://www.cve.org/CVERecord?id=CVE-2004-0696
CVE-2002-0433 List files in web server using "*.ext"
https://www.cve.org/CVERecord?id=CVE-2002-0433
CVE-2001-1152 Proxy allows remote attackers to bypass denylist restrictions and connect to
unauthorized web servers by modifying the requested URL, including (1) a //
(double slash), (2) a /SUBDIR/.. where the desired file is in the parentdir, (3)
a /./, or (4) URL-encoded characters.
https://www.cve.org/CVERecord?id=CVE-2001-1152
CVE-2000-0191 application check access for restricted URL before canonicalization
https://www.cve.org/CVERecord?id=CVE-2000-0191
CVE-2005-1366 CGI source disclosure using "dirname/../cgi-bin"
https://www.cve.org/CVERecord?id=CVE-2005-1366
CVE-1999-0012 Multiple web servers allow restriction bypass using 8.3 names instead of long
names
https://www.cve.org/CVERecord?id=CVE-1999-0012
CVE-2001-0795 Source code disclosure using 8.3 file name.
https://www.cve.org/CVERecord?id=CVE-2001-0795
CVE-2005-0471 Multi-Factor Vulnerability. Product generates temporary filenames using long
filenames, which become predictable in 8.3 format.
https://www.cve.org/CVERecord?id=CVE-2005-0471
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
CWE Version 4.14
CWE-42: Path Equivalence: 'filename.' (Trailing Dot)
CWE-42: Path Equivalence: 'filename.' (Trailing Dot)