CVE-2016-5803

Опубликовано: 13 фев. 2017

Источник: nvd

CVSS3: 8.6

CVSS2: 7.5

EPSS Низкий

Описание

An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier. The Unified Infrastructure Management software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Ссылки

http://www.securityfocus.com/bid/94243
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-315-01
Mitigation
Third Party Advisory
US Government Resource
https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html
http://www.securityfocus.com/bid/94243
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-315-01
Mitigation
Third Party Advisory
US Government Resource
https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ca_technologies:unified_infrastructure_management:*:*:*:*:*:*:*:*

Версия до 8.47 (включая)

EPSS

Процентиль: 90%

0.05421

Низкий

8.6 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-5768-2586-2x4j