CVE-2011-1389 Path traversal in n/a

What is CVE-2011-1389?

CVE-2011-1389 is a critical path traversal vulnerability in n/a, published on 19 Jan 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files. NOTE: this might overlap CVE-2011-4135.

Weakness: CWE-22

Which versions are affected by CVE-2011-1389?

It affects 3 products.

Products include Ibm Rational License Key Server, Ibm Rational License Server, Ibm Telelogic License Server.

How do I fix CVE-2011-1389?

No fix has been published for CVE-2011-1389 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2011-1389 being exploited?

There is no known exploitation of CVE-2011-1389 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-0909 Information disclosure in n/a Medium 5.0
• CVE-2015-1907 Information disclosure in n/a Medium 4.0
• CVE-2014-4756 Auth bypass in n/a Low 3.5
• CVE-2015-5045 Information disclosure in n/a Low 3.3
• CVE-2014-3079 Missing authorization in n/a Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2r8x-hfx4-m6x7.