Etype Eserv 2.97 allows remote attackers to view password protected files via /./ in the URL.
CVSS Metrics