Vulnerability Details : CVE-2014-100015
Public exploit exists!
Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. (dot dot) in the filename in a file upload.
Vulnerability category: Directory traversal
Products affected by CVE-2014-100015
- cpe:2.3:a:solidworks:product_data_management:2014:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-100015
62.52%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2014-100015
-
SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write
Disclosure Date: 2014-02-22First seen: 2020-04-26exploit/windows/misc/solidworks_workgroup_pdmwservice_file_writeThis module exploits a remote arbitrary file write vulnerability in SolidWorks Workgroup PDM 2014 SP2 and prior. For targets running Windows Vista or newer the payload is written to the startup folder for all users and executed upon next user logon. For tar
CVSS scores for CVE-2014-100015
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:P |
10.0
|
4.9
|
NIST |
CWE ids for CVE-2014-100015
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-100015
-
http://www.exploit-db.com/exploits/32163
SolidWorks Workgroup PDM 2014 - 'pdmwService.exe' Arbitrary File Write (Metasploit) - Windows remote ExploitExploit
-
http://packetstormsecurity.com/files/125361
SolidWorks Workgroup PDM 2014 SP2 Arbitrary File Write ≈ Packet StormExploit
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/91518
SolidWorks Workgroup PDM pdmwService.exe directory traversal CVE-2014-100015 Vulnerability Report
-
http://www.exploit-db.com/exploits/31831
SolidWorks Workgroup PDM 2014 SP2 - Arbitrary File Write - Windows remote ExploitExploit
Jump to