Advisory Details

July 7th, 2016

Novell NetIQ Sentinel Server ReportViewServlet fileName Directory Traversal Information Disclosure Vulnerability

CVE ID	CVE-2016-1605
CVSS SCORE	6.8, AV:N/AC:L/Au:S/C:C/I:N/A:N
AFFECTED VENDORS	Novell
AFFECTED PRODUCTS	NetIQ Sentinel
VULNERABILITY DETAILS	This vulnerability allows remote attackers to disclose arbitrary file contents on vulnerable installations of Novell NetIQ Sentinel Server. Authentication is required to exploit this vulnerability but it can be bypassed using a separate flaw within the LogonFormController. The specific flaw exists within the ReportViewServlet servlet. When fileType is specified as "PREVIEW", the fileName parameter is vulnerable to directory traversal. An attacker could leverage this vulnerability to read the content of arbitrary files from the system.
ADDITIONAL DETAILS	Novell has issued an update to correct this vulnerability. More details can be found at: https://www.netiq.com/support/kb/doc.php?id=7017803
DISCLOSURE TIMELINE	2016-05-09 - Vulnerability reported to vendor 2016-07-07 - Coordinated public release of advisory
CREDIT	rgod

BACK TO ADVISORIES