Vulnerability Details : CVE-2015-2995

Public exploit exists!
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
Published 2015-06-08 14:59:04
Updated 2018-10-09 19:56:35
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Directory traversal

Exploit prediction scoring system (EPSS) score for CVE-2015-2995

EPSS FAQ
89.98%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2015-2995

  • SysAid Help Desk 'rdslogs' Arbitrary File Upload
    Disclosure Date: 2015-06-03
    First seen: 2020-04-26
    exploit/multi/http/sysaid_rdslogs_file_upload
    This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4. The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated file uploads and handles zip file contents in an insecure way. By combining both weaknesses, a rem

CVSS scores for CVE-2015-2995

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.8
 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
 NIST

CWE ids for CVE-2015-2995

  • The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-2995

Products affected by CVE-2015-2995

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close