Back to CVE Browser

CVE-2013-1080

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1840%

EPSS Percentile2.34th

PublishedMar 29, 2013

Last ModifiedApr 29, 2026

Vulnerability Description

The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.

Affected Platforms (CPE)

📦

Novell

Zenworks Configuration Management

= 10.3

📦

Novell

Zenworks Configuration Management

= 11.2

References & Advisories

🔗 http://www.exploit-db.com/exploits/24938

🔗 http://www.novell.com/support/kb/doc.php?id=7011812

🔗 http://www.novell.com/support/kb/doc.php?id=7012027

🔗 http://www.zerodayinitiative.com/advisories/ZDI-13-049/

🔗 http://www.exploit-db.com/exploits/24938

🔗 http://www.novell.com/support/kb/doc.php?id=7011812

🔗 http://www.novell.com/support/kb/doc.php?id=7012027

🔗 http://www.zerodayinitiative.com/advisories/ZDI-13-049/

Related Vulnerabilities

CVE-2010-532310.0

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ...

CVE-2010-532410.0

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ...

CVE-2010-422910.0

Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novel...

CVE-2011-317510.0

Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote ...