CVE-2010-4095

Published: Oct 26, 2010Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Directory traversal vulnerability in the FTP client in Serengeti Systems Incorporated Robo-FTP 3.7.3, and probably other versions before 3.7.5, allows remote FTP servers to write arbitrary files via a .. (dot dot) in a filename in a server response.

Affected (2)

Products: Robo Ftp: Robo Ftp

Robo Ftp

1 product

Robo Ftp

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Robo Ftp Robo Ftp	Version 3.7.3
Robo Ftp Robo Ftp	Version 3.7.4

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (12)

http://kb.robo-ftp.com/change_log/show/77

Source: cve@mitre.org

http://secunia.com/advisories/41809

Source: cve@mitre.org

Vendor Advisory

http://www.htbridge.ch/advisory/directory_traversal_vulnerability_in_robo_ftp.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/514267/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/44073

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/62548

Source: cve@mitre.org

http://kb.robo-ftp.com/change_log/show/77