CVE-2016-1610 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Novell	Filr

Configuration 1 [-]

OR	cpe:2.3:a:novell:filr::security_update_2::::::*
	cpe:2.3:a:novell:filr::security_update_1::::::*

No data.

References

Link	Providers
http://seclists.org/bugtraq/2016/Jul/119
http://www.securityfocus.com/bid/92113
https://download.novell.com/Download?buildid=3V-3ArYN85I~
https://download.novell.com/Download?buildid=BOTiHcBFfv0~
https://www.exploit-db.com/exploits/40161/
https://www.novell.com/support/kb/doc.php?id=7017788

History

No history.

MITRE

Status: PUBLISHED

Assigner: microfocus

Published: 2016-08-01T01:00:00

Updated: 2024-08-05T23:02:12.359Z

Reserved: 2016-01-12T00:00:00

Link: CVE-2016-1610

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-08-01T02:59:08.493

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-1610

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-07-25T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T16:15:50", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"name": "20160725 SEC Consult SA-20160725-0 :: Multiple vulnerabilities in Micro Focus (Novell) Filr", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://seclists.org/bugtraq/2016/Jul/119"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://download.novell.com/Download?buildid=3V-3ArYN85I~"}, {"name": "40161", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/40161/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.novell.com/support/kb/doc.php?id=7017788"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://download.novell.com/Download?buildid=BOTiHcBFfv0~"}, {"name": "92113", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92113"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "ID": "CVE-2016-1610", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20160725 SEC Consult SA-20160725-0 :: Multiple vulnerabilities in Micro Focus (Novell) Filr", "refsource": "BUGTRAQ", "url": "http://seclists.org/bugtraq/2016/Jul/119"}, {"name": "https://download.novell.com/Download?buildid=3V-3ArYN85I~", "refsource": "CONFIRM", "url": "https://download.novell.com/Download?buildid=3V-3ArYN85I~"}, {"name": "40161", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/40161/"}, {"name": "https://www.novell.com/support/kb/doc.php?id=7017788", "refsource": "CONFIRM", "url": "https://www.novell.com/support/kb/doc.php?id=7017788"}, {"name": "https://download.novell.com/Download?buildid=BOTiHcBFfv0~", "refsource": "CONFIRM", "url": "https://download.novell.com/Download?buildid=BOTiHcBFfv0~"}, {"name": "92113", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92113"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:02:12.359Z"}, "title": "CVE Program Container", "references": [{"name": "20160725 SEC Consult SA-20160725-0 :: Multiple vulnerabilities in Micro Focus (Novell) Filr", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://seclists.org/bugtraq/2016/Jul/119"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://download.novell.com/Download?buildid=3V-3ArYN85I~"}, {"name": "40161", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/40161/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.novell.com/support/kb/doc.php?id=7017788"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://download.novell.com/Download?buildid=BOTiHcBFfv0~"}, {"name": "92113", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92113"}]}]}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2016-1610", "datePublished": "2016-08-01T01:00:00", "dateReserved": "2016-01-12T00:00:00", "dateUpdated": "2024-08-05T23:02:12.359Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:novell:filr:*:security_update_2:*:*:*:*:*:*", "matchCriteriaId": "F030D30C-EE26-498C-A0FC-C9895B920AE8", "versionEndIncluding": "1.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:novell:filr:*:security_update_1:*:*:*:*:*:*", "matchCriteriaId": "AE256C8E-7C3D-48BE-9A84-9FF00777A5CF", "versionEndIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en la caracter\u00edstica email-template en Novell Filr en versiones anteriores a 1.2 Security Update 3 y 2.0 en versiones anteriores a Security Update 2 permite a atacantes remotos eludir restricciones destinadas al acceso y escribir a archivos arbitrarios a trav\u00e9s de .. (punto punto) en un nombre del blob."}], "id": "CVE-2016-1610", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-08-01T02:59:08.493", "references": [{"source": "security@opentext.com", "url": "http://seclists.org/bugtraq/2016/Jul/119"}, {"source": "security@opentext.com", "url": "http://www.securityfocus.com/bid/92113"}, {"source": "security@opentext.com", "url": "https://download.novell.com/Download?buildid=3V-3ArYN85I~"}, {"source": "security@opentext.com", "url": "https://download.novell.com/Download?buildid=BOTiHcBFfv0~"}, {"source": "security@opentext.com", "url": "https://www.exploit-db.com/exploits/40161/"}, {"source": "security@opentext.com", "url": "https://www.novell.com/support/kb/doc.php?id=7017788"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/bugtraq/2016/Jul/119"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/92113"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://download.novell.com/Download?buildid=3V-3ArYN85I~"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://download.novell.com/Download?buildid=BOTiHcBFfv0~"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/40161/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.novell.com/support/kb/doc.php?id=7017788"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}