CVE-2011-1736
Directory traversal vulnerability in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to read arbitrary files via directory traversal sequences in a filename in a GET_FILE…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Directory traversal vulnerability in OmniInet.exe in the Backup Client Service in HP OpenView Storage Data Protector 6.00, 6.10, and 6.11 allows remote attackers to read arbitrary files via directory traversal sequences in a filename in a GET_FILE message.
- CVSS 2.0
- 8.5 HIGHAV:N/AC:L/Au:N/C:C/I:N/A:P
- EPSS
- 9.77% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- hp/openview storage data protector
- Source
- hp-security-alert@hp.com
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240Vendor Advisory
- http://osvdb.org/72195
- http://secunia.com/advisories/44402
- http://www.securityfocus.com/archive/1/517772/100/0/threaded
- http://www.securityfocus.com/bid/47638
- http://www.securitytracker.com/id?1025454
- http://zerodayinitiative.com/advisories/ZDI-11-152/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67209
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02810240Vendor Advisory
- http://osvdb.org/72195
- http://secunia.com/advisories/44402
- http://www.securityfocus.com/archive/1/517772/100/0/threaded
- http://www.securityfocus.com/bid/47638
- http://www.securitytracker.com/id?1025454
- http://zerodayinitiative.com/advisories/ZDI-11-152/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67209
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.