CVE-2011-0497 Path traversal in n/a
Remote attackers can read arbitrary files on Sybase EAServer via directory traversal sequences in crafted requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-0497?
CVE-2011-0497 is a high-severity path traversal vulnerability in n/a, published on 20 Jan 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to read arbitrary files via "../\" (dot dot forward-slash backslash) sequences in a crafted request.
Weakness: CWE-22
Which versions are affected by CVE-2011-0497?
It affects 4 products.
Products include Sybase Appeon for Powerbuilder, Sybase Easerver, Sybase Replication Server, Sybase Sybase Workspace.
How do I fix CVE-2011-0497?
No fix has been published for CVE-2011-0497 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2011-0497 being exploited?
There is no known exploitation of CVE-2011-0497 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hcjh-vxw9-5294.