Analyst readout for executives and security teams
Plain-English summary
This old vulnerability lets a remote attacker read files from affected Tarantella Enterprise servers through a directory traversal flaw in a CGI endpoint. Business risk depends on whether any legacy Tarantella 3.00 or 3.01 web interface remains reachable, especially from the internet.
Executive priority
Prioritize quickly if any affected Tarantella server is internet-facing or stores sensitive local files. Otherwise, handle as a legacy exposure review with a strong bias toward retirement or isolation.
Technical view
CVE-2001-0805 is a directory traversal issue in ttawebtop.cgi in Tarantella Enterprise 3.00 and 3.01. The public record says attackers can use parent-directory input in the pg parameter to read arbitrary files. The bundle provides no CVSS, CWE, patch version, or confirmed active exploitation.
Likely exposure
Exposure is likely limited to legacy environments still running Tarantella Enterprise 3.00 or 3.01 with ttawebtop.cgi accessible. Internet-facing deployments are the highest concern because the issue is described as remotely reachable and affects file confidentiality.
Exploitation context
The sources describe remote arbitrary file read, but the bundle does not show CISA KEV listing or any cited evidence of active exploitation. Treat exploit status as unconfirmed, not absent, because this is a historically public web CGI vulnerability.
Researcher notes
The public bundle is sparse: no CVSS, CWE, patch, CPE, or detailed vendor remediation is included. Analysis is grounded only in the CVE description and linked vulnerability database or mailing-list references. Do not assume affected versions beyond 3.00 and 3.01.
Mitigation direction
- Inventory and retire unsupported Tarantella Enterprise 3.00 or 3.01 deployments.
- Check historical vendor guidance for any supported fix or workaround.
- Remove public access to Tarantella web interfaces where possible.
- Restrict access to trusted networks and authenticated administrative paths.
- Monitor for traversal attempts against ttawebtop.cgi and pg-like parameters.
Validation and detection
- Confirm whether Tarantella Enterprise 3.00 or 3.01 exists in the environment.
- Identify any reachable ttawebtop.cgi endpoints in web server inventories.
- Review logs for parent-directory traversal patterns targeting the CGI endpoint.
- Verify network controls block untrusted access to the web interface.
- Document compensating controls when systems cannot be upgraded or retired.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
File access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2001-0805 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 2890CVE reference · vdb-entry, x_refsource_BID
- 20010618 SCO Tarantella Remote file read via ttawebtop.cgiCVE reference · mailing-list, x_refsource_BUGTRAQ
- tarantella-ttawebtop-read-files(6723)CVE reference · vdb-entry, x_refsource_XF
- 20010619 Re: SCO Tarantella Remote file read via ttawebtop.cgiCVE reference · mailing-list, x_refsource_BUGTRAQ
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.