CVE-2011-0497: Path Traversal
Published Jan 20, 2011
·Updated
Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to read arbitrary files via "../\" (dot dot forward-slash backslash) sequences in a crafted request.
Affected Software
34 affected components
Sybase Appeon For Powerbuilder=2.5
Sybase Appeon For Powerbuilder=2.6
Sybase Appeon For Powerbuilder=2.7
Sybase Appeon For Powerbuilder=2.8
Sybase Appeon For Powerbuilder=6.0
Sybase Appeon For Powerbuilder=6.1
Sybase Appeon For Powerbuilder=6.2
Sybase Appeon For Powerbuilder=6.5
Sybase EAServer=5.0
Sybase EAServer=5.0.1
Sybase EAServer=5.1
Sybase EAServer=5.2
Sybase EAServer=5.2.1
Sybase EAServer=5.3
Sybase EAServer=5.5
Sybase EAServer=6.0
Sybase EAServer=6.0.2
Sybase EAServer=6.1
Sybase EAServer=6.2
Sybase EAServer=6.3
Sybase EAServer=6.3.1
Sybase Replication Server
Sybase Replication Server=15.2
Sybase Sybase Workspace
Sybase Sybase Workspace=1.0
Sybase Sybase Workspace=1.5
Sybase Sybase Workspace=1.6
Sybase Sybase Workspace=1.7
Sybase Sybase Workspace=2.0
Sybase Sybase Workspace=2.0.1
Sybase Sybase Workspace=2.0.2
Sybase Sybase Workspace=2.1
Sybase Sybase Workspace=2.1.2
Sybase Sybase Workspace=2.5
Event History
Jan 20, 2011
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
07:00 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2011-0497?
CVE-2011-0497 is classified as a medium severity vulnerability.
2
How do I fix CVE-2011-0497?
To fix CVE-2011-0497, update to Sybase EAServer version 6.3 ESD#2 or later.
3
What type of vulnerability is CVE-2011-0497?
CVE-2011-0497 is a directory traversal vulnerability.
4
Which software is affected by CVE-2011-0497?
CVE-2011-0497 affects Sybase EAServer and SAP Appeon for PowerBuilder versions prior to a specific update.
5
Can CVE-2011-0497 allow unauthorized file access?
Yes, CVE-2011-0497 allows remote attackers to read arbitrary files through crafted requests.