NVD

Id
31176  
Name
CVE-2014-2846  
Description
Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-04-28  
Modified Date
2014-04-29  
Seq
2014-2846  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
163595 31176 CVE-2014-2846 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances  View
163596 31176 CVE-2014-2846 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13418 JVNDB-2014-002293 WD Arkeia Virtual Appliance のファームウェアの opt/arkeia/wui/htdocs/index.php におけるディレクトリトラバーサルの脆弱性 WD Arkeia Virtual Appliance (AVA) のファームウェアの opt/arkeia/wui/htdocs/index.php には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2014-2846 70133 CVE-2014-2846 31176 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002293.html 2014-04-21 2014-05-01 View