CNCVE编号：CNCVE-20020013 CVE编号： 安全级别：中 漏洞中文描述： Sun Cobalt RaQ是ISPs使用的一种服务方软件。据报告，Cobalt RaQ易受目录遍历漏洞攻击。比如http://10.0.0.1:82/.cobalt/sysManage/../admin/.htaccess利用该漏洞，远程用户可以非法读取敏感文件，尚未得知是否可以遍历HTTP根目录之外的目录。 漏洞英文描述： RaQ is a server appliance originally developed by Cobalt. It is now distributed and maintained by Sun Microsystems. Due to insufficient sanitization of input, it is possible to execute script code on Cobalt RaQ systems. The problem occurs in the filtering of maliciously HTML tags when passed to the service.cgi and alert.cgi scripts. It has been reported that by passing malicious script code through the search.cgi or alert.cgi scripts, it may be possible to place malicious content on pages hosted by the RaQ server. 漏洞参考： http://archives.neohapsis.com/archives/bugtraq/2002-02/0351.html http://archives.neohapsis.com/archives/bugtraq/2002-02/0371.html http://www.sun.com 系统类型：其他 漏洞类型：输入有效性检查错误