CVE-2009-0615

Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to "invalid directory permissions."

CVSS v2.0 9.0 HIGH

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml	Vendor Advisory
http://www.securityfocus.com/bid/33903
http://www.securitytracker.com/id?1021770
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml	Vendor Advisory
http://www.securityfocus.com/bid/33903
http://www.securitytracker.com/id?1021770

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:application_control_engine_device_manager::::::::
	cpe:2.3:a:cisco:application_control_engine_device_manager:1.1:::::::*
	cpe:2.3:a:cisco:application_networking_manager::::::::
	cpe:2.3:a:cisco:application_networking_manager:1.1:::::::*

History

21 Nov 2024, 01:00

Type	Values Removed	Values Added
References	~~() http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml - Vendor Advisory~~	() http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/33903 -~~	() http://www.securityfocus.com/bid/33903 -
References	~~() http://www.securitytracker.com/id?1021770 -~~	() http://www.securitytracker.com/id?1021770 -

Information

Published : 2009-02-26 16:17

Updated : 2024-11-21 01:00

NVD link : CVE-2009-0615

Mitre link : CVE-2009-0615

CVE.ORG link : CVE-2009-0615

JSON object : View

Products Affected

cisco

application_networking_manager
application_control_engine_device_manager

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2009-0615", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-02-26T16:17:20.030", "references": [{"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/33903", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id?1021770", "source": "ykramarz@cisco.com"}, {"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/33903", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id?1021770", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to \"invalid directory permissions.\""}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en Cisco Application Networking Manager (ANM) anterior a v2.0 y Application Control Engine (ACE) Device Manager anterior a vA3(2.1) permite a usuarios atenticados remotamente leer o modificar ficheros de su elecci\u00f3n a atrav\u00e9s de vectores sin especificar relacionados con \"permisos de directorio inv\u00e1lido\"."}], "lastModified": "2024-11-21T01:00:31.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:application_control_engine_device_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D4DDB47-1E38-47B5-A77E-B967A0C11ADB", "versionEndIncluding": "1.2"}, {"criteria": "cpe:2.3:a:cisco:application_control_engine_device_manager:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A02EE9C-8E93-409E-823A-08C8C9ADE002"}, {"criteria": "cpe:2.3:a:cisco:application_networking_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E917E6B-F744-49D3-8516-132C8684F3D4", "versionEndIncluding": "1.2"}, {"criteria": "cpe:2.3:a:cisco:application_networking_manager:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E427057-56BC-4E7C-8DBA-0388A6C81C87"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}