CVE-2010-0284

Novell Access Manager - Path Traversal and Arbitrary File Write via PortalModuleInstallManager getEntry Method

Title source: llm

Description

Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/59528

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1024132

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/40198

Vendor Advisory x_refsource_confirm

http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2010/1516

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/40931

Scores

EPSS 0.0682

EPSS Percentile 91.4%

Details

CWE

CWE-22

Status published

Products (1)

novell/access_manager 3.1 (2 CPE variants)

Published Jun 18, 2010

Tracked Since Feb 18, 2026