{"id":"CVE-2008-0457","url":"https://www.cyber-defence.io/tools/cve/CVE-2008-0457","generatedAt":"2026-10-27T18:39:25.350Z","title":"Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP…","description":"Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.","published":"2008-02-07T21:00:00.000Z","lastModified":"2026-06-16T22:49:41.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":10,"severity":"HIGH","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C"},"cwe":["CWE-20"],"affected":["symantec/backupexec system recovery"],"epss":{"score":0.11863,"percentile":0.96067,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":2,"verified":true,"firstPublished":"2007-01-05","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":5078,"kind":"exploit","title":"Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload","url":"https://www.exploit-db.com/exploits/5078","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/5078.html","file":"exploits/windows/remote/5078.html","published":"2008-02-07","added":"2008-02-06","updated":"2016-11-14","author":"titon","type":"remote","platform":"windows","port":null,"verified":true,"codes":["CVE-2008-0457"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":31072,"kind":"exploit","title":"Symantec Backup Exec System Recovery Manager 7.0 - FileUpload Class Unauthorized File Upload","url":"https://www.exploit-db.com/exploits/31072","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/31072.html","file":"exploits/windows/remote/31072.html","published":"2007-01-05","added":"2007-01-05","updated":"2014-01-20","author":"titon","type":"remote","platform":"windows","port":null,"verified":true,"codes":["CVE-2008-0457","OSVDB-41149"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/27487/info"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 11.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://secunia.com/advisories/28787","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://seer.entsupport.symantec.com/docs/297171.htm","tags":["Patch"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/487688/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/27487","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id?1019303","source":"cve@mitre.org"},{"url":"http://www.symantec.com/avcenter/security/Content/2008.02.04.html","tags":["Patch"],"source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2008/0413","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-003.html","source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/5078","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/28787","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seer.entsupport.symantec.com/docs/297171.htm","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/487688/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/27487","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id?1019303","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.symantec.com/avcenter/security/Content/2008.02.04.html","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2008/0413","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-003.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/5078","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-0457","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}