CVE-2013-6030

Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.16473 allows remote attackers to read arbitrary files via unspecified vectors, as demonstrated by reading the /etc/passwd file.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.kb.cert.org/vuls/id/168751	US Government Resource
http://www.securityfocus.com/bid/65105
http://www.kb.cert.org/vuls/id/168751	US Government Resource
http://www.securityfocus.com/bid/65105

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:emerson:network_power_avocent_mergepoint_unity_2016_firmware:1.9.16473:*:*:*:*:*:*:*

cpe:2.3:o:emerson:network_power_avocent_mergepoint_unity_2016_firmware:1.9.16473:*:*:*:*:*:*:*

History

21 Nov 2024, 01:58

Type	Values Removed	Values Added
References	~~() http://www.kb.cert.org/vuls/id/168751 - US Government Resource~~	() http://www.kb.cert.org/vuls/id/168751 - US Government Resource
References	~~() http://www.securityfocus.com/bid/65105 -~~	() http://www.securityfocus.com/bid/65105 -

Information

Published : 2014-01-24 04:38

Updated : 2024-11-21 01:58

NVD link : CVE-2013-6030

Mitre link : CVE-2013-6030

CVE.ORG link : CVE-2013-6030

JSON object : View

Products Affected

emerson

network_power_avocent_mergepoint_unity_2016_firmware

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2013-6030", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-01-24T04:38:09.620", "references": [{"url": "http://www.kb.cert.org/vuls/id/168751", "tags": ["US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/65105", "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/168751", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/65105", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.16473 allows remote attackers to read arbitrary files via unspecified vectors, as demonstrated by reading the /etc/passwd file."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en el switch KVM Emerson Network Power Avocent MergePoint Unity 2016 (tambi\u00e9n conocido como MPU2016) con firmware 1.9.16473 permite a atacantes remotos leer ficheros arbitrarios a trav\u00e9s de vectores no especificados, como se muestra leyendo el fichero /etc/passwd."}], "lastModified": "2024-11-21T01:58:39.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:emerson:network_power_avocent_mergepoint_unity_2016_firmware:1.9.16473:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD1E7755-17BB-4465-8999-BCD0C5AEF5A5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:emerson:network_power_avocent_mergepoint_unity_2016_firmware:1.9.16473:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94C0BAF1-9C83-4AA9-AFCC-50FD958043F5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cret@cert.org"}