CVE-2016-1610
HighSummary
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.
Risk Assessment
Attackers may gain access to sensitive data or overwrite files on the server, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update Novell Filr to the latest version to mitigate this vulnerability and implement additional security measures against directory traversal attacks.
Other vulnerabilities in Novell Filr
See all- CVE-2016-1611High
Novell Filr version 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 has world-writable permissions for the /etc/profile.d/vainit.sh file, allowing local users to gain elevated privileges by replacing this file's content with arbitrary shell commands.
- CVE-2016-1608High
In Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2, remote authenticated users can execute arbitrary commands via shell metacharacters in the ntpServer parameter.
- CVE-2016-1607High
Multiple CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request.
Original NVD description (English source)
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.