CVE-2015-2166

2015-04-0615:59:02

CWE-22

[email protected]

web.nvd.nist.gov

cve

2015

2166

directory traversal

vulnerability

ericsson

drutt mobile

msdp

instance monitor

security

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9 High

AI Score

Confidence

High

0.296 Low

EPSS

Percentile

97.0%

JSON

Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a …%2f (dot dot encoded slash) in the default URI.

Affected configurations

NVD

Node

ericssondrutt_mobile_service_delivery_platformMatch4.0

ericssondrutt_mobile_service_delivery_platformMatch5.0

ericssondrutt_mobile_service_delivery_platformMatch6.0

CPENameOperatorVersion
ericsson:drutt_mobile_service_delivery_platformericsson drutt mobile service delivery platformeq4.0
ericsson:drutt_mobile_service_delivery_platformericsson drutt mobile service delivery platformeq5.0
ericsson:drutt_mobile_service_delivery_platformericsson drutt mobile service delivery platformeq6.0

CPE	Name	Operator	Version
ericsson:drutt_mobile_service_delivery_platform	ericsson drutt mobile service delivery platform	eq	4.0
ericsson:drutt_mobile_service_delivery_platform	ericsson drutt mobile service delivery platform	eq	5.0
ericsson:drutt_mobile_service_delivery_platform	ericsson drutt mobile service delivery platform	eq	6.0