CVE-2006-3426
Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a ..
Does this matter?
Lower severity and a low EPSS score (2.67%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a .. (dot dot) sequence in the (1) action, (2) agentid, or (3) index parameters to dagent/nwupload.asp, which are used as pathname components.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.67% probability · 85th percentile
- CISA KEV
- Not listed
- Affected
- lumension/patchlink update server · novell/zenworks
- Source
- cve@mitre.org
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html
- http://secunia.com/advisories/20876Vendor Advisory
- http://secunia.com/advisories/20878Vendor Advisory
- http://securityreason.com/securityalert/1200
- http://securitytracker.com/id?1016405
- http://www.securityfocus.com/archive/1/438710/100/0/threaded
- http://www.securityfocus.com/bid/18732
- http://www.vupen.com/english/advisories/2006/2595
- http://www.vupen.com/english/advisories/2006/2596
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html
- http://secunia.com/advisories/20876Vendor Advisory
- http://secunia.com/advisories/20878Vendor Advisory
- http://securityreason.com/securityalert/1200
- http://securitytracker.com/id?1016405
- http://www.securityfocus.com/archive/1/438710/100/0/threaded
- http://www.securityfocus.com/bid/18732
- http://www.vupen.com/english/advisories/2006/2595
- http://www.vupen.com/english/advisories/2006/2596
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.