CVE-2013-1080
Novell ZENworks Configuration Management < 11.2.4 - Directory Traversal & Arbitrary File Upload
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-1080.
PoCs published by Metasploit, James Burton, juan vazquez, including Metasploit module exploits/multi/http/zenworks_control_center_upload.
AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in Novell ZENworks Configuration Management to upload a malicious WAR file outside the intended directory, leading to remote code execution. It supports both Windows and Linux targets.
Description
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
Exploits (2)
This Metasploit module exploits a directory traversal vulnerability in Novell ZENworks Configuration Management to upload a malicious WAR file outside the intended directory, leading to remote code execution. It supports both Windows and Linux targets.
This Metasploit module exploits a directory traversal and file upload vulnerability in Novell ZENworks Configuration Management, allowing unauthenticated remote code execution by uploading a malicious WAR file and triggering its deployment.