by Kastro
Paper/Archive/CVE-2015-4068

CVE-2015-4068

Arcserve Unified Data Protection (UDP) — Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability

KEV · due 15 AprEPSS 64%public exploitSSVC actCVSS 9.1
critical.is priorityof 100
97
CVSS 9.1 (ADP)9.1 / 10 × 3027.3In CISA KEV+3030.0EPSS percentile 99.2.992 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refzerodayinitiative.com/advisories/ZDI-15-242refsecurityfocus.com/bid/74845refdocumentation.arcserve.com/Arcserve-UDP/Available/V5/ENU/Bookshelf_Files/HTML/Update%204/UDP_Update4_ReleaseNotes.htmlrefzerodayinitiative.com/advisories/ZDI-15-241refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4068kevcisa.gov/known-exploited-vulnerabilities-catalog