Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2008-0221: Gateway Weblaunch lets remote attackers run programs

CVE-2008-0221 · published 18 years ago

Summary

The WebLaunch component used in Gateway Weblaunch can be tricked into running any program if an attacker supplies a special "..\" path in a launch request. This could let an outsider execute code on your system without permission. Update the Weblaunch software or apply the vendor's patch to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gateway	weblaunch	1.0.0.1 `cpe:2.3:a:gateway:weblaunch:1.0.0.1:::::::*`

Original advisory text

Directory traversal vulnerability in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gateway Weblaunch allows remote attackers to execute arbitrary programs via a ..\ (dot dot backslash) in the second argument to the DoWebLaunch method. NOTE: some of these details are obtained from third party information.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.3 Critical

Exploitation

6% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published10 Jan 2008

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2008-0221 · NVD

Track software like this

Free during beta