Novell NetIQ Sentinel Server ReportViewServlet fileName Directory Traversal Information Disclosure VulnerabilityZDI-16-406: July 7th, 2016
This vulnerability allows remote attackers to disclose arbitrary file contents on vulnerable installations of Novell NetIQ Sentinel Server. Authentication is required to exploit this vulnerability but it can be bypassed using a separate flaw within the LogonFormController.
The specific flaw exists within the ReportViewServlet servlet. When fileType is specified as "PREVIEW", the fileName parameter is vulnerable to directory traversal. An attacker could leverage this vulnerability to read the content of arbitrary files from the system.
Vendor ResponseNovell has issued an update to correct this vulnerability. More details can be found at:
2016-05-09 - Vulnerability reported to vendor
2016-07-07 - Coordinated public release of advisory
CreditThis vulnerability was discovered by: