CVE-2008-2241 : Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup

Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allows remote attackers to append arbitrary data to arbitrary files via directory traversal sequences in unspecified input fields, which are used in log messages. NOTE: this can be leveraged for code execution in many installation environments by writing to a startup file or configuration file.

Published 2008-05-21 13:24:00

Updated 2021-04-09 18:54:02

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2008-2241

CA » Brightstor Arcserve Backup » Version: R11.0
cpe:2.3:a:ca:brightstor_arcserve_backup:r11.0:*:*:*:*:*:*:*
Matching versions
CA » Brightstor Arcserve Backup » Version: 11.0
cpe:2.3:a:ca:brightstor_arcserve_backup:11.0:*:*:*:*:*:*:*
Matching versions
CA » Business Protection Suite » Version: 2.0 Microsoft Small Business Server Standard Edition
cpe:2.3:a:ca:business_protection_suite:2.0:*:microsoft_small_business_server_standard:*:*:*:*:*
Matching versions
CA » Business Protection Suite » Version: 2.0 Microsoft Small Business Server Premium Edition
cpe:2.3:a:ca:business_protection_suite:2.0:*:microsoft_small_business_server_premium:*:*:*:*:*
Matching versions
Broadcom » Brightstor Arcserve Backup » Version: 11.1
cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.1:*:*:*:*:*:*:*
Matching versions
Broadcom » Brightstor Arcserve Backup » Version: 11.5
cpe:2.3:a:broadcom:brightstor_arcserve_backup:11.5:*:*:*:*:*:*:*
Matching versions
Broadcom » Server Protection Suite » Version: 2
cpe:2.3:a:broadcom:server_protection_suite:2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2008-2241

EPSS FAQ

39.73%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-2241

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2008-2241

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-2241

Jump to

Vulnerability Details : CVE-2008-2241

Products affected by CVE-2008-2241

Exploit prediction scoring system (EPSS) score for CVE-2008-2241

CVSS scores for CVE-2008-2241

CWE ids for CVE-2008-2241

References for CVE-2008-2241