medium6.8Public exploit code
CVE-2011-0966
Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote atta…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CiscoWorks Common Services 3.1.1 - Auditing Directory Traversal2011-05-18 · webapps · java · Verified
- Cisco Unified Operations Manager - Multiple Vulnerabilities2011-05-18 · remote · windows · Verified
Impact
Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Ciscoworks Common Services | through 3.3 Versions 1.0, 2.2, 3.0, 3.0.3, 3.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23089
- http://www.exploit-db.com/exploits/17304
- http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67525
- http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23089
- http://www.exploit-db.com/exploits/17304
- http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67525