CVE-2010-0620
EMC HomeBase SSL Service Arbitrary File Upload Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content, and consequently execute arbitrary code, via a .. (dot dot) in an unspecified parameter.
Una vulnerabilidad de salto del directorio en Servicio SSL en HomeBase Server de EMC, versiones 6.2.x anteriores a 6.2.3 y versiones 6.3.x anteriores a 6.3.2, permite a los atacantes remotos sobrescribir archivos arbitrarios con cualquier contenido y en consecuencia, ejecutar código arbitrario por medio de un .. (punto punto) en un parámetro no especificado.
This vulnerability allows remote attackers to upload arbitrary files on vulnerable installations of EMC HomeBase Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the HomeBase SSL Service due to a failure to sanitize '../' directory traversal modifiers from a parameter. This will allow a user to specify any filename to upload arbitrary contents into. Successful exploitation can result in code execution under the context of the service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2010-02-11 CVE Reserved
- 2010-02-23 CVE Published
- 2011-04-27 First Exploit
- 2024-05-30 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://securityreason.com/securityalert/8230 | Third Party Advisory | |
| http://www.securityfocus.com/archive/1/509723/100/0/threaded | Mailing List | |
| http://www.zerodayinitiative.com/advisories/ZDI-10-020 | X_refsource_misc |
|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/17219 | 2011-04-27 | |
| http://www.securityfocus.com/bid/38380 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.vupen.com/english/advisories/2010/0458 | 2018-10-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Emc Search vendor "Emc" | Homebase Server Search vendor "Emc" for product "Homebase Server" | 6.2 Search vendor "Emc" for product "Homebase Server" and version "6.2" | - |
Affected
| ||||||
| Emc Search vendor "Emc" | Homebase Server Search vendor "Emc" for product "Homebase Server" | 6.3 Search vendor "Emc" for product "Homebase Server" and version "6.3" | - |
Affected
| ||||||