APP: Novell ZENworks Configuration Management newDocumentWizard Directory Traversal
This signature detects attempts to exploit a known vulnerability in Novell ZENworks Configuration Management. It is due to insufficient input validation within the ZENworks Server's newDocumentWizard. Successful exploitation could allow an attacker to execute arbitrary code on the vulnerable system with Administrator privileges.
Extended Description
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
Affected Products
Novell zenworks_configuration_management
Short Name
APP:NOVELL:ZENWORKSCM-DIRTRVRSL
Severity
Major
Recommended
False
Recommended Action
Drop
Category
APP
Keywords
CVE-2013-1080 Configuration Directory Management Novell Traversal ZENworks bid:58668 newDocumentWizard
Release Date
06/11/2013
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
False Positive
Unknown
Vendors
Novell
CVSS Score
10.0