CVE-2010-4229

Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks Configuration Management 10.3 before 10.3.2, and 11, allows remote attackers to overwrite files, and subsequently execute arbitrary code, via directory traversal sequences in a filename field in an upload request.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/44120	Vendor Advisory
http://securityreason.com/securityalert/8207
http://securitytracker.com/id?1025313
http://www.novell.com/support/viewContent.do?externalId=7007841	Vendor Advisory
http://www.securityfocus.com/archive/1/517425/100/0/threaded
http://www.securityfocus.com/bid/47295
http://www.vupen.com/english/advisories/2011/0917	Vendor Advisory
http://zerodayinitiative.com/advisories/ZDI-11-118/
https://exchange.xforce.ibmcloud.com/vulnerabilities/66656

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:novell:zenworks_configuration_management:10.3:::::::*
	cpe:2.3:a:novell:zenworks_configuration_management:10.3.1:::::::*
	cpe:2.3:a:novell:zenworks_configuration_management:11:::::::*

History

No history.

Information

Published : 2011-04-18 18:55

Updated : 2018-10-10 20:07

NVD link : CVE-2010-4229

Mitre link : CVE-2010-4229

CVE.ORG link : CVE-2010-4229

JSON object : View

Products Affected

novell

zenworks_configuration_management

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2010-4229", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-04-18T18:55:00.797", "references": [{"url": "http://secunia.com/advisories/44120", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/8207", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1025313", "source": "cve@mitre.org"}, {"url": "http://www.novell.com/support/viewContent.do?externalId=7007841", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/517425/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/47295", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2011/0917", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://zerodayinitiative.com/advisories/ZDI-11-118/", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66656", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks Configuration Management 10.3 before 10.3.2, and 11, allows remote attackers to overwrite files, and subsequently execute arbitrary code, via directory traversal sequences in a filename field in an upload request."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en Componente de inventario en ZENworks Asset Management en Novell ZENworks Configuration Management v10.3 anteriores a v10.3.2 y v11, permite a atacantes remotos incluir y ejecutar ficheros locales de su elecci\u00f3n al utilizar caracteres .. (punto punto) en el campo nombre de fichero en una petici\u00f3n de subida de ficheros."}], "lastModified": "2018-10-10T20:07:31.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:novell:zenworks_configuration_management:10.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ABC25E5-76CD-469B-879A-B1F7109D0181"}, {"criteria": "cpe:2.3:a:novell:zenworks_configuration_management:10.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "556F4B13-4C98-41D6-A2A4-138780C206CD"}, {"criteria": "cpe:2.3:a:novell:zenworks_configuration_management:11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98942F6C-330F-459A-B2B4-72572DB4070E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}