CVE-2006-4900

Severity

55%

Complexity

80%

Confidentiality

81%

Directory traversal vulnerability in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, allows remote authenticated users to read and delete arbitrary files via ".." sequences in the eSCCAdHocHtmlFile parameter to eSMPAuditServlet, which is not properly handled by the getadhochtml function.

Directory traversal vulnerability in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, allows remote authenticated users to read and delete arbitrary files via ".." sequences in the eSCCAdHocHtmlFile parameter to eSMPAuditServlet, which is not properly handled by the getadhochtml function.

CVSS 2.0 Base Score 5.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:P).

Overview

First reported 18 years ago

2006-09-22 22:07:00

Last updated 6 years ago

2018-10-17 21:40:00

Affected Software

Computer Associates eTrust Security Command Center r8

8

Computer Associates eTrust Security Command Center r8 SP1 CR1

8

Computer Associates eTrust Security Command Center r8 SP1 CR2

8

References

22023

Exploit, Patch, Vendor Advisory

1016910

http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt

Exploit, Patch, Vendor Advisory

29010

Exploit, Patch

20060921 [CAID 34616, 34617, 34618]: CA eSCC and eTrust Audit vulnerabilities

20060922 RE: Computer Associates eTrust Security Command Center Multiple Vulnerabilities

20139

ADV-2006-3738

http://www3.ca.com/securityadvisor/blogs/posting.aspx?id=90744&pid=93243&date=2006/9

Exploit, Patch, Vendor Advisory

http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34617

Patch, Vendor Advisory

ca-etrust-esmpauditservlet-dir-traversal(29104)

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.