CVE-2013-2068 : Multiple directory traversal vulnerabilities in the AgentController in Red Hat C

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.

Published 2013-09-28 19:55:03

Updated 2014-01-14 04:24:40

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2013-2068

Redhat » Cloudforms Management Engine » Version: 5.1
cpe:2.3:a:redhat:cloudforms_management_engine:5.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2013-2068

EPSS FAQ

58.43%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2013-2068

Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal

Disclosure Date: 2013-09-04

First seen: 2020-04-26

exploit/linux/http/cfme_manageiq_evm_upload_exec

This module exploits a path traversal vulnerability in the "linuxpkgs" action of "agent" controller of the Red Hat CloudForms Management Engine 5.1 (ManageIQ Enterprise Virtualization Manager 5.0 and earlier). It uploads a fake controller to the controllers directory

More information

CVSS scores for CVE-2013-2068

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.4	HIGH	AV:N/AC:L/Au:N/C:N/I:C/A:C	10.0	9.2	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2013-2068

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-2068

https://bugzilla.redhat.com/show_bug.cgi?id=960422

960422 – (CVE-2013-2068) CVE-2013-2068 CFME 2.0 multiple zip file upload path traversal vulnerabilities
http://www.exploit-db.com/exploits/30469

RedHat CloudForms Management Engine 5.1 - agent/linuxpkgs Directory Traversal (Metasploit) - Linux remote Exploit
http://rhn.redhat.com/errata/RHSA-2013-1206.html

RHSA-2013:1206 - Security Advisory - Red Hat Customer Portal
Vendor Advisory

Jump to