CVE-2012-2215

Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://download.novell.com/Download?buildid=rs4B5jhWKf8~	Patch
http://www.novell.com/support/viewContent.do?externalId=7010044
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html	Patch
http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=975
https://exchange.xforce.ibmcloud.com/vulnerabilities/74189

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:novell:zenworks_configuration_management:11.1:::::::*
	cpe:2.3:a:novell:zenworks_configuration_management:11.1a:::::::*

Information

Published : 2012-04-09 14:55

Updated : 2017-08-28 18:31

NVD link : CVE-2012-2215

Mitre link : CVE-2012-2215

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Products Affected

novell

zenworks_configuration_management

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://download.novell.com/Download?buildid=rs4B5jhWKf8~", "name": "http://download.novell.com/Download?buildid=rs4B5jhWKf8~", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.novell.com/support/viewContent.do?externalId=7010044", "name": "http://www.novell.com/support/viewContent.do?externalId=7010044", "tags": [], "refsource": "CONFIRM"}, {"url": "http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html", "name": "http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=975", "name": "20120314 Novell ZENworks Configuration Management PreBoot Service Opcode 0x21 Arbitrary File Download Vulnerability", "tags": [], "refsource": "IDEFENSE"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74189", "name": "zenworks-preboot-file-download(74189)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2012-2215", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2012-04-09T21:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:novell:zenworks_configuration_management:11.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:novell:zenworks_configuration_management:11.1a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-29T01:31Z"}

5.0 /10