{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-06-17T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "accessmgr-admincosole-getentry-file-upload(59528)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}, {"name": "1024132", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1024132"}, {"name": "40198", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/40198"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"name": "ADV-2010-1516", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"name": "40931", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/40931"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2010-0284", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "accessmgr-admincosole-getentry-file-upload(59528)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}, {"name": "1024132", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1024132"}, {"name": "40198", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/40198"}, {"name": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1", "refsource": "CONFIRM", "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"name": "ADV-2010-1516", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"name": "40931", "refsource": "BID", "url": "http://www.securityfocus.com/bid/40931"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T00:45:11.744Z"}, "title": "CVE Program Container", "references": [{"name": "accessmgr-admincosole-getentry-file-upload(59528)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}, {"name": "1024132", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1024132"}, {"name": "40198", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/40198"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"name": "ADV-2010-1516", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"name": "40931", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/40931"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2010-0284", "datePublished": "2010-06-18T16:00:00", "dateReserved": "2010-01-12T00:00:00", "dateUpdated": "2024-08-07T00:45:11.744Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:novell:access_manager:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "2617E396-621F-40AD-86B7-8E2158E4A54F", "vulnerable": true}, {"criteria": "cpe:2.3:a:novell:access_manager:3.1:sp1:*:*:*:*:*:*", "matchCriteriaId": "DAE304CE-1BEB-413C-A16C-320C606D7BA6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents, and consequently execute arbitrary code, via a .. (dot dot) in a parameter, aka ZDI-CAN-678."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en el m\u00e9todo getEntry en el componente PortalModuleInstallManager en un servlet en nps.jar en la Consola de administraci\u00f3n (Administration Console, tambi\u00e9n conocida como Access Management Console) en Novell Access Manager v3.1 anteriores a v3.1.2-281 en Windows, permite a atacantes remotos crear ficheros de su elecci\u00f3n con cualquier contenido, y consecuentemente ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un .. (punto punto) en un par\u00e1metro, tambi\u00e9n conocido como ZDI-CAN-678."}], "id": "CVE-2010-0284", "lastModified": "2017-08-17T01:31:57.053", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2010-06-18T16:30:01.313", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40198"}, {"source": "cve@mitre.org", "url": "http://www.novell.com/support/viewContent.do?externalId=7006255&sliceId=1"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/40931"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1024132"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/1516"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59528"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}