CVE-2015-4666

NUCLEI

Xceedium Xsuite - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.

Exploits (1)

exploitdb WRITEUP

by modzero · textwebappsphp

https://www.exploit-db.com/exploits/37708

View Code ZIP pw:eip

Nuclei Templates (1)

Xceedium Xsuite <=2.4.4.5 - Local File Inclusion

MEDIUMby 0x_Akoko

References (4)

[Exploit] http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html

[Exploit] http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt

[Various Sources] https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/37708/

Scores

EPSS 0.1639

EPSS Percentile 94.9%

Details

CWE

CWE-22

Status published

Products (2)

xceedium/xsuite 2.3.0

xceedium/xsuite 2.4.3.0

Published Aug 13, 2015

Tracked Since Feb 18, 2026