CVE-2015-0785 Path traversal in n/a

High 7.5 Published 9 Aug 2017 Updated 6 Aug 2024

Remote attackers can read arbitrary folders in Novell ZENworks Configuration Management via the dirname variable.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-0785?

CVE-2015-0785 is a high-severity path traversal vulnerability in n/a, published on 9 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders via the dirname variable.

Weakness: CWE-200

Which versions are affected by CVE-2015-0785?

It affects 1 product.

Products include Novell Zenworks Configuration Management.

How do I fix CVE-2015-0785?

No fix has been published for CVE-2015-0785 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2015-0785 being exploited?

There is no known exploitation of CVE-2015-0785 in the wild and no public exploit code.

Sources

Also known as GHSA-854h-gmvf-x57p.