CVE-2013-1080

The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

77.05% chance of exploitation in the next 30 days, 100th percentile

Published

2013-03-29

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/24938

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/zenworks_control_cent…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/24938

References

• CVE Record
• NVD entry

Related

• CVE-2013-1055
• CVE-2013-1081
• CVE-2013-1054
• CVE-2013-1114
• CVE-2013-1017
• CVE-2013-1120