CVE-2010-0284 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Windows
Novell	Access Manager

Configuration 1 [-]

AND

OR	cpe:2.3:a:novell:access_manager:3.1:::::::*
	cpe:2.3:a:novell:access_manager:3.1:sp1::::::

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/40198
http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1
http://www.securityfocus.com/bid/40931
http://www.securitytracker.com/id?1024132
http://www.vupen.com/english/advisories/2010/1516
https://exchange.xforce.ibmcloud.com/vulnerabilities/59528

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2010-06-18T16:00:00

Updated: 2024-08-07T00:45:11.744Z

Reserved: 2010-01-12T00:00:00

Link: CVE-2010-0284

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2010-06-18T16:30:01.313

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-0284

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-06-17T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "accessmgr-admincosole-getentry-file-upload(59528)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}, {"name": "1024132", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1024132"}, {"name": "40198", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/40198"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"name": "ADV-2010-1516", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"name": "40931", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/40931"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2010-0284", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "accessmgr-admincosole-getentry-file-upload(59528)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}, {"name": "1024132", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1024132"}, {"name": "40198", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/40198"}, {"name": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1", "refsource": "CONFIRM", "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"name": "ADV-2010-1516", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"name": "40931", "refsource": "BID", "url": "http://www.securityfocus.com/bid/40931"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T00:45:11.744Z"}, "title": "CVE Program Container", "references": [{"name": "accessmgr-admincosole-getentry-file-upload(59528)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}, {"name": "1024132", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1024132"}, {"name": "40198", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/40198"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"name": "ADV-2010-1516", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"name": "40931", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/40931"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2010-0284", "datePublished": "2010-06-18T16:00:00", "dateReserved": "2010-01-12T00:00:00", "dateUpdated": "2024-08-07T00:45:11.744Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:novell:access_manager:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "2617E396-621F-40AD-86B7-8E2158E4A54F", "vulnerable": true}, {"criteria": "cpe:2.3:a:novell:access_manager:3.1:sp1:*:*:*:*:*:*", "matchCriteriaId": "DAE304CE-1BEB-413C-A16C-320C606D7BA6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en el m\u00e9todo getEntry en el componente PortalModuleInstallManager en un servlet en nps.jar en la Consola de administraci\u00f3n (Administration Console, tambi\u00e9n conocida como Access Management Console) en Novell Access Manager v3.1 anteriores a v3.1.2-281 en Windows, permite a atacantes remotos crear ficheros de su elecci\u00f3n con cualquier contenido, y consecuentemente ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un .. (punto punto) en un par\u00e1metro, tambi\u00e9n conocido como ZDI-CAN-678."}], "id": "CVE-2010-0284", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2010-06-18T16:30:01.313", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40198"}, {"source": "cve@mitre.org", "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/40931"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1024132"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40198"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/40931"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1024132"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}