CVE-2008-4397

2008-10-1421:10:00

CWE-20

CWE-22

[email protected]

web.nvd.nist.gov

security

vulnerability

directory traversal

ca arcserve backup

remote attackers

arbitrary commands

nvd

cve-2008-4397

7.4 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.888 High

EPSS

Percentile

98.7%

JSON

Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a … (dot dot) in an RPC call with opnum 0x10A.

CPENameOperatorVersion
ca:business_protection_suiteca business protection suiteeqr2
ca:arcserve_backupca arcserve backupeqr11.1
ca:arcserve_backupca arcserve backupeqr11.5
broadcom:arcserve_backupbroadcom arcserve backupeqr12.0
broadcom:business_protection_suitebroadcom business protection suiteeqr2
broadcom:server_protection_suitebroadcom server protection suiteeqr2

CPE	Name	Operator	Version
ca:business_protection_suite	ca business protection suite	eq	r2
ca:arcserve_backup	ca arcserve backup	eq	r11.1
ca:arcserve_backup	ca arcserve backup	eq	r11.5
broadcom:arcserve_backup	broadcom arcserve backup	eq	r12.0
broadcom:business_protection_suite	broadcom business protection suite	eq	r2
broadcom:server_protection_suite	broadcom server protection suite	eq	r2