NVD

Id
17099  
Name
CVE-2016-0709  
Description
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."  
Reject
 
CVSS Version
2  
CVSS Score
9  
Severity
High  
CVSS Base Score
9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2016-04-11  
Modified Date
2016-04-20  
Seq
2016-0709  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
94802 17099 CVE-2016-0709 http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and  View
94803 17099 CVE-2016-0709 http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html  View
94804 17099 CVE-2016-0709 http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload  View
94805 17099 CVE-2016-0709 [portals-jetspeed-user] 20160303 [CVE-2016-0709] Apache Jetspeed information disclosure vulnerability  View
94806 17099 CVE-2016-0709 https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709  View
94807 17099 CVE-2016-0709 39643  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1356 JVNDB-2016-002129 Apache Jetspeed の Portal Site Manager の Import/Export 関数におけるディレクトリトラバーサルの脆弱性 Apache Jetspeed の Portal Site Manager の Import/Export 関数には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2016-0709 86913 CVE-2016-0709 17099 9 7.2 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002129.html 2016-03-03 2016-04-21 View