CVE-2010-0284
Novell Access Manager Arbitrary File Upload Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678.
Vulnerabilidad de salto de directorio en el método getEntry en el componente PortalModuleInstallManager en un servlet en nps.jar en la Consola de administración (Administration Console, también conocida como Access Management Console) en Novell Access Manager v3.1 anteriores a v3.1.2-281 en Windows, permite a atacantes remotos crear ficheros de su elección con cualquier contenido, y consecuentemente ejecutar código de su elección a través de un .. (punto punto) en un parámetro, también conocido como ZDI-CAN-678.
This vulnerability allows remote attackers to upload arbitrary files on vulnerable installations of Novell Access Manager. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the PortalModuleInstallManager component of the Novell Management Console which exists within the servlet located within nps.jar. Due to a failure to sanitize '../' directory traversal modifiers from a parameter an attacker can specify any filename to upload arbitrary contents into. Successful exploitation can result in code execution under the context of the service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2010-01-12 CVE Reserved
- 2010-06-18 CVE Published
- 2024-08-07 CVE Updated
- 2024-11-04 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1 | X_refsource_confirm | |
| http://www.securityfocus.com/bid/40931 | Vdb Entry | |
| http://www.securitytracker.com/id?1024132 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/59528 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/40198 | 2017-08-17 | |
| http://www.vupen.com/english/advisories/2010/1516 | 2017-08-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Novell Search vendor "Novell" | Access Manager Search vendor "Novell" for product "Access Manager" | 3.1 Search vendor "Novell" for product "Access Manager" and version "3.1" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Novell Search vendor "Novell" | Access Manager Search vendor "Novell" for product "Access Manager" | 3.1 Search vendor "Novell" for product "Access Manager" and version "3.1" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|