GroundWork Monitor Enterprise CVE-2013-3504 Directory Traversal Vulnerability

Bugtraq ID:	59779
Class:	Input Validation Error
CVE:	CVE-2013-3504
Remote:	Yes
Local:	No
Published:	May 08 2013 12:00AM
Updated:	May 08 2013 12:00AM
Credit:	Johannes Greil
Vulnerable:	GroundWork GroundWork Monitor Enterprise 6.7
Not Vulnerable:

GroundWork Monitor Enterprise CVE-2013-3504 Directory Traversal Vulnerability

GroundWork Monitor Enterprise is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to overwrite arbitrary files in the context of the affected application. Other attacks may also be possible.

GroundWork Monitor Enterprise 6.7.0 is vulnerable; other versions may also be affected.

GroundWork Monitor Enterprise CVE-2013-3504 Directory Traversal Vulnerability

An attacker can exploit this issue using a web browser.

GroundWork Monitor Enterprise CVE-2013-3504 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GroundWork Monitor Enterprise CVE-2013-3504 Directory Traversal Vulnerability

References:

• GroundWork Homepage (GroundWork)
  
• SEC Consult Vulnerability Multiple critical vulnerabilities in Groundwork (SEC Consult Vulnerability)
  
• VU#345260 GroundWork Monitor Enterprise contains multiple vulnerabilities (CERT)