CVEvulnerability
CVE-2013-6221
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-06-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-22
Description
Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-2031.
Affected configurations
• hp service virtualization 3.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://packetstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.html packetstormsecurity.com
- http://www.exploit-db.com/exploits/33891 www.exploit-db.com
- http://www.osvdb.org/107943 www.osvdb.org
- http://www.securitytracker.com/id/1030385 www.securitytracker.com
- http://zerodayinitiative.com/advisories/ZDI-14-195/ zerodayinitiative.com
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_autopass_license_traversal.rb github.com
- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04333125 Vendor Advisory
- http://packetstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.html packetstormsecurity.com
- http://www.exploit-db.com/exploits/33891 www.exploit-db.com
- http://www.osvdb.org/107943 www.osvdb.org
- http://www.securitytracker.com/id/1030385 www.securitytracker.com
- http://zerodayinitiative.com/advisories/ZDI-14-195/ zerodayinitiative.com
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_autopass_license_traversal.rb github.com
- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04333125 Vendor Advisory