Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-5324 — Path Traversal in Zenworks Configuration Management

CWE-22 — Path Traversal4 documents4 sources
Severity
10.0CRITICALNVD
EPSS
74.1%
top 1.16%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Novell Zenworks Configuration Management
Timeline
PublishedJun 7
Latest updateMay 17

Description

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages1 packages

Patches

Patch: www.novell.com ↗Patch: www.novell.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9mwj-265r-f2gr: Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10↗2022-05-17
▶
CVEList
CVE-2010-5324: Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10↗2015-06-07
▶

💥Exploits & PoCs

1
Exploit-DB
Novell ZENworks Configuration Management 10.2.0 - Remote Execution (Metasploit)↗2010-11-22
▶
CVE-2010-5324 — Path Traversal | cvebase