Serena Dimensions CM 'DOWNLOAD' Command Security Bypass Vulnerability

Bugtraq ID:	35337
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 12 2009 12:00AM
Updated:	Jun 22 2009 07:49PM
Credit:	Roland Gruber
Vulnerable:	Serena Dimensions CM 10.1
Not Vulnerable:

Serena Dimensions CM 'DOWNLOAD' Command Security Bypass Vulnerability

Serena Dimensions CM is prone to a vulnerability that may allow attackers to bypass certain security restrictions.

An authenticated attacker can exploit this issue to view files without having the proper permission to do so.

Serena Dimensions 10.1 and later versions are affected.

Serena Dimensions CM 'DOWNLOAD' Command Security Bypass Vulnerability

Attackers can exploit this issue via the application's Desktop Client.

Serena Dimensions CM 'DOWNLOAD' Command Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: The vendor reports that this is the application's documented default behavior. Also, an administrator can switch off the privilege. We may retire this BID pending further investigation.

Serena Dimensions CM 'DOWNLOAD' Command Security Bypass Vulnerability

References:

• Dimensions CM Homepage (Serena)
  
• Serena Dimensions CM has insufficient default privileges ([email protected])