medium5.5Public exploit code
CVE-2013-6720
Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- IBM Tealeaf CX 8.8 - Remote OS Command Injection2014-03-26 · webapps · php
Impact
Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. (dot dot) in the log parameter, as demonstrated using a crafted request for a customer-support file, as demonstrated by a log file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Tealeaf Cx | Versions 7.1, 7.2, 8.0, 8.1, 8.2, 8.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.exploit-db.com/exploits/32546
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89229
- https://tealeaf.support.ibmcloud.com/FileManagement/Download/19eb90ffb8334b398684b4350edc4b7a
- http://www.exploit-db.com/exploits/32546
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89229
- https://tealeaf.support.ibmcloud.com/FileManagement/Download/19eb90ffb8334b398684b4350edc4b7a