Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2009-12-21T16:00:00
Updated: 2024-08-07T06:54:10.347Z
Reserved: 2009-12-09T00:00:00
Link: CVE-2009-4261
Vulnrichment
No data.
NVD
Status : Modified
Published: 2009-12-21T16:30:00.390
Modified: 2024-11-21T01:09:16.090
Link: CVE-2009-4261
Redhat
No data.