CVE-2013-5486

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnmVendor Advisory
http://www.exploit-db.com/exploits/30008Exploit, Third Party Advisory, VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-dcnmVendor Advisory
http://www.exploit-db.com/exploits/30008Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Sep 23, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-54877.8DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary files via unspecif CVE-2013-54885.0Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS), Cisco Security Manager, Cisco Unified Service Monitor, and Cisc CVE-2013-54895.0The gadget implementation in Cisco SocialMiner does not properly restrict the content of GET requests, which allows remote attackers to obta CVE-2013-54907.8Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary text files via an XML external entity CVE-2013-54925.0administration.jsp in Cisco SocialMiner allows remote attackers to obtain sensitive information by sniffing the network for HTTP client-serv CVE-2013-54936.8The diagnostic module in the firmware on Cisco Virtualization Experience Client 6000 devices allows local users to bypass intended access re CVE-2013-54946.8Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Unified MeetingPlace Solution, as used in Unified MeetingPlace CVE-2013-54954.3Cross-site scripting (XSS) vulnerability in the web framework in the Application Server in Cisco Unified MeetingPlace allows remote attacker CVE-2013-54966.3Open Network Environment Platform (ONEP) in Cisco NX-OS allows remote authenticated users to cause a denial of service (network-element relo CVE-2013-54974.3The authentication manager process in the web framework in Cisco Intrusion Prevention System (IPS) does not properly handle user tokens, whi CVE-2013-54985.0The PPTP-ALG component in CRS Carrier Grade Services Engine (CGSE) and ASR 9000 Integrated Service Module (ISM) in Cisco IOS XR allows remot CVE-2013-54995.7The remember feature in the DHCP server in Cisco IOS allows remote attackers to cause a denial of service (device reload) by acquiring a lea