CVEvulnerability
CVE-2008-0457
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-02-07
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
Affected configurations
• symantec backupexec system recovery 7.0
• symantec backupexec system recovery 7.01
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://secunia.com/advisories/28787 Vendor Advisory
- http://seer.entsupport.symantec.com/docs/297171.htm Patch
- http://www.securityfocus.com/archive/1/487688/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27487 Exploit
- http://www.securitytracker.com/id?1019303 www.securitytracker.com
- http://www.symantec.com/avcenter/security/Content/2008.02.04.html Patch
- http://www.vupen.com/english/advisories/2008/0413 Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-003.html www.zerodayinitiative.com
- https://www.exploit-db.com/exploits/5078 www.exploit-db.com
- http://secunia.com/advisories/28787 Vendor Advisory
- http://seer.entsupport.symantec.com/docs/297171.htm Patch
- http://www.securityfocus.com/archive/1/487688/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27487 Exploit
- http://www.securitytracker.com/id?1019303 www.securitytracker.com
- http://www.symantec.com/avcenter/security/Content/2008.02.04.html Patch
- http://www.vupen.com/english/advisories/2008/0413 Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-003.html www.zerodayinitiative.com
- https://www.exploit-db.com/exploits/5078 www.exploit-db.com