Lucene search

K
zdiRgodZDI-16-406
HistoryJul 07, 2016 - 12:00 a.m.

Novell NetIQ Sentinel Server ReportViewServlet fileName Directory Traversal Information Disclosure Vulnerability

2016-07-0700:00:00
rgod
www.zerodayinitiative.com
7

EPSS

0.465

Percentile

97.5%

This vulnerability allows remote attackers to disclose arbitrary file contents on vulnerable installations of Novell NetIQ Sentinel Server. Authentication is required to exploit this vulnerability but it can be bypassed using a separate flaw within the LogonFormController. The specific flaw exists within the ReportViewServlet servlet. When fileType is specified as “PREVIEW”, the fileName parameter is vulnerable to directory traversal. An attacker could leverage this vulnerability to read the content of arbitrary files from the system.

EPSS

0.465

Percentile

97.5%