CVE-2008-2015

Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) CompactSave and (2) SaveSession method in one control, and the (3) saveRecordedExploreToFile method in a different control.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
VendorProductVersion
watchfireappscan
7.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/28940
http://www.securitytracker.com/id?1019948
https://exchange.xforce.ibmcloud.com/vulnerabilities/42077
https://www.exploit-db.com/exploits/5496
http://www.securityfocus.com/bid/28940
http://www.securitytracker.com/id?1019948
https://exchange.xforce.ibmcloud.com/vulnerabilities/42077
https://www.exploit-db.com/exploits/5496