CVE-2010-0284 Path traversal in n/a
Remote attackers with high privileges can exploit a directory traversal flaw in the Administration Console to create arbitrary files and execute code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-0284?
CVE-2010-0284 is a critical path traversal vulnerability in n/a, published on 18 Jun 2010. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678.
Weakness: CWE-22
Which versions are affected by CVE-2010-0284?
It affects 1 product.
Products include Novell Access Manager.
How do I fix CVE-2010-0284?
No fix has been published for CVE-2010-0284 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2010-0284 being exploited?
There is no known exploitation of CVE-2010-0284 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2007-1309 Security feature bypass in n/a
- CVE-2007-3570 Security feature bypass in n/a
- CVE-2009-4878 Unspecified vulnerability in the Administration Console in Novell Access Manager before 3.1 SP1 allows attackers to access system files via
- CVE-2009-4879 Auth bypass in n/a
- CVE-2008-6722 Information disclosure in n/a
Sources
Also known as GHSA-22m7-r3qp-8jxg.