JVN#03050861: EXPRESSCLUSTER X vulnerable to directory traversal

EXPRESSCLUSTER X from NEC Corporation is software to provide high availability (HA) clustering. EXPRESSCLUSTER X contains an issue in WebManager, which may lead to directory traversal.

Impact

Arbitrary files on the server may be viewed by an attacker who can access to the WebManager.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Apply a Workaround
The following workarounds may mitigate the affects of this vulnerability.

• Enable access restriction by IP address
• Enable access restriction by password

Products Affected

• EXPRESSCLUSTER X 3.3 for Windows (Internal Ver. 11.31) or earlier
• EXPRESSCLUSTER X 3.3 for Linux (Internal Ver. 3.3.1-1) or earlier
• EXPRESSCLUSTER X 3.3 for Solaris (Internal Ver. 3.3.1-1) or earlier