CVE-2008-3685 Path traversal in n/a
Remote attackers can upload arbitrary files and execute code via directory traversal in EMC Documentum ApplicationXtender Workflow Admin Agent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-3685?
CVE-2008-3685 is a critical path traversal vulnerability in n/a, published on 22 Oct 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlier, allows remote attackers to upload arbitrary files, and execute arbitrary code, via directory traversal sequences in requests to TCP port 2606.
Weakness: CWE-22
Which versions are affected by CVE-2008-3685?
It affects 1 product.
Products include Emc Documentum Applicationxtender Workflow Manager.
How do I fix CVE-2008-3685?
No fix has been published for CVE-2008-3685 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2008-3685 being exploited?
There is no known exploitation of CVE-2008-3685 in the wild and no public exploit code.
Sources
Also known as GHSA-g99p-ffv8-649c.