VulnerabilityModified
CVE-2013-4510
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
HIGH 7.8EPSS 2.17%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:N/I:C/A:N
- EPSS
- 2.17% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- tryton/tryton
- Source
- secalert@redhat.com
References
- http://hg.tryton.org/tryton/rev/357d0a4d9cb8Exploit, Patch
- http://www.debian.org/security/2013/dsa-2791
- http://www.openwall.com/lists/oss-security/2013/11/04/21
- http://www.tryton.org/posts/security-release-for-issue3446.htmlVendor Advisory
- https://bugs.tryton.org/issue3446Patch
- http://hg.tryton.org/tryton/rev/357d0a4d9cb8Exploit, Patch
- http://www.debian.org/security/2013/dsa-2791
- http://www.openwall.com/lists/oss-security/2013/11/04/21
- http://www.tryton.org/posts/security-release-for-issue3446.htmlVendor Advisory
- https://bugs.tryton.org/issue3446Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.