CVE-2013-3706

Novell ZENworks Configuration Management 11.2 - Unauthenticated Path Traversal via PreBoot Update Pathname

Title source: llm

Description

Directory traversal vulnerability in the PreBoot service in Novell ZENworks Configuration Management (ZCM) 11.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a preboot update pathname, aka ZDI-CAN-1595.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_confirm

http://www.novell.com/support/kb/doc.php?id=7014663

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/65912

Scores

EPSS 0.5047

EPSS Percentile 97.9%

Details

CWE

CWE-22

Status published

Products (1)

novell/zenworks_configuration_management 11.2

Published Mar 06, 2014

Tracked Since Feb 18, 2026