CVE-2005-1930 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, and possibly earlier versions, allows remote attackers to read arbitrary files via the IMAGE parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00873.

Key SSVC decision points have not yet been added.

Vendors	Products
Trend Micro	Serverprotect

Configuration 1 [-]

cpe:2.3:a:trend_micro:serverprotect:5.58:*:emc:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2005-1932	Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, and possibly earlier versions, allows remote attackers to read arbitrary files via the IMAGE parameter.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/18038
http://securityreason.com/securityalert/258
http://securitytracker.com/id?1015358
http://www.idefense.com/application/poi/display?id=352&type=vulnerabilities
http://www.osvdb.org/21770
http://www.securityfocus.com/bid/15867
http://www.vupen.com/english/advisories/2005/2907

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2005-12-14T20:00:00

Updated: 2024-08-07T22:06:57.667Z

Reserved: 2005-06-08T00:00:00

Link: CVE-2005-1930

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2005-12-14T20:07:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2005-1930

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2005-12-14T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, and possibly earlier versions, allows remote attackers to read arbitrary files via the IMAGE parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2005-12-20T10:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "18038", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/18038"}, {"name": "1015358", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1015358"}, {"name": "15867", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/15867"}, {"name": "20051214 Trend Micro ServerProtect Crystal Reports ReportServer File Disclosure", "tags": ["third-party-advisory", "x_refsource_IDEFENSE"], "url": "http://www.idefense.com/application/poi/display?id=352&type=vulnerabilities"}, {"name": "21770", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/21770"}, {"name": "258", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/258"}, {"name": "ADV-2005-2907", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2005/2907"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2005-1930", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, and possibly earlier versions, allows remote attackers to read arbitrary files via the IMAGE parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "18038", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/18038"}, {"name": "1015358", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1015358"}, {"name": "15867", "refsource": "BID", "url": "http://www.securityfocus.com/bid/15867"}, {"name": "20051214 Trend Micro ServerProtect Crystal Reports ReportServer File Disclosure", "refsource": "IDEFENSE", "url": "http://www.idefense.com/application/poi/display?id=352&type=vulnerabilities"}, {"name": "21770", "refsource": "OSVDB", "url": "http://www.osvdb.org/21770"}, {"name": "258", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/258"}, {"name": "ADV-2005-2907", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2005/2907"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T22:06:57.667Z"}, "title": "CVE Program Container", "references": [{"name": "18038", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/18038"}, {"name": "1015358", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1015358"}, {"name": "15867", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/15867"}, {"name": "20051214 Trend Micro ServerProtect Crystal Reports ReportServer File Disclosure", "tags": ["third-party-advisory", "x_refsource_IDEFENSE", "x_transferred"], "url": "http://www.idefense.com/application/poi/display?id=352&type=vulnerabilities"}, {"name": "21770", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/21770"}, {"name": "258", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/258"}, {"name": "ADV-2005-2907", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2005/2907"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2005-1930", "datePublished": "2005-12-14T20:00:00", "dateReserved": "2005-06-08T00:00:00", "dateUpdated": "2024-08-07T22:06:57.667Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trend_micro:serverprotect:5.58:*:emc:*:*:*:*:*", "matchCriteriaId": "1364240C-2070-4CEA-BAE9-E94EAFFBBF1D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1, and possibly earlier versions, allows remote attackers to read arbitrary files via the IMAGE parameter."}, {"lang": "es", "value": "Vulnerabilidad de atravesamiento de directorios en componente Crystal Report (rptserver.asp) en Tren Micro Server Protect Managemente Console 5.58, usada en Control Manager 2.5 y 3.0 y Damage Cleanup Server 1.1, y posiblemente versiones anteriores, permite a atacantes remotos leer ficheros de su elecci\u00f3n mediante el par\u00e1metro IMAGE."}], "id": "CVE-2005-1930", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2005-12-14T20:07:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/18038"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/258"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1015358"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.idefense.com/application/poi/display?id=352&type=vulnerabilities"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/21770"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/15867"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2005/2907"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/18038"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1015358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.idefense.com/application/poi/display?id=352&type=vulnerabilities"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/21770"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/15867"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2005/2907"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}