CVE-2004-2021

MEDIUM 5.0CVE-2004-2021 · Published 31/12/2004 · updated 16/06/2026

In short

CVE-2004-2021 is a MEDIUM (CVSS 5.0) vulnerability affecting oscommerce (oscommerce).
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 90.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
oscommerce oscommerce	`= 2.1= 2.2_cvs= 2.2_ms1= 2.2_ms2= 2.2_ms3`	No fix yet

Description

Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. (dot dot) in the filename argument.

References

archives.neohapsis.com/archives/bugtraq/2005-03/0378.html
marc.info
secunia.com/advisories/11624
securitytracker.com/id
excluded.org/advisories/advisory13.txt · URL Repurposed
osvdb.org/6308
securityfocus.com/bid/10364 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/16174

More vulnerabilities in oscommerce

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

oscommerce

= 2.1= 2.2_cvs= 2.2_ms1= 2.2_ms2= 2.2_ms3

No fix yet

More vulnerabilities in oscommerce

See all →