Signature Detail
Short Name |
APP:NOVELL:ZENWORKSCM-DIRTRVRSL |
|---|---|
Severity |
High |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
APP |
Keywords |
Novell ZENworks Configuration Management newDocumentWizard Directory Traversal |
Release Date |
2013/06/11 |
Update Number |
2271 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
APP: Novell ZENworks Configuration Management newDocumentWizard Directory Traversal
This signature detects attempts to exploit a known vulnerability in Novell ZENworks Configuration Management. It is due to insufficient input validation within the ZENworks Server's newDocumentWizard. Successful exploitation could allow an attacker to execute arbitrary code on the vulnerable system with Administrator privileges.
Extended Description
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
Affected Products
- novell zenworks_configuration_management 10.3
- novell zenworks_configuration_management 11.2
References
- BugTraq: 58668
- CVE: CVE-2013-1080