CVE-2016-1610

HIGH

Novell Filr <1.2 SU3, 2.0 SU2 - Path Traversal

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-1610. PoCs published by SEC Consult.

AI-analyzed exploit summary This is a detailed security advisory from SEC Consult describing multiple vulnerabilities in Micro Focus Filr, including CSRF, OS command injection, XSS, and authentication bypass. It includes proof-of-concept code for exploiting these vulnerabilities.

Description

Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.

Exploits (1)

exploitdb WRITEUP VERIFIED

by SEC Consult · textwebappsjava

https://www.exploit-db.com/exploits/40161

View Code ZIP pw:eip

This is a detailed security advisory from SEC Consult describing multiple vulnerabilities in Micro Focus Filr, including CSRF, OS command injection, XSS, and authentication bypass. It includes proof-of-concept code for exploiting these vulnerabilities.

Classification

Writeup 100%

Attack Type

Rce, Xss, Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: Micro Focus Filr 2 <=2.0.0.421, Filr 1.2 <= 1.2.0.846

No auth needed

Prerequisites: Network access to the target system · For some exploits, an authenticated session

MITRE ATT&CK