CVE-2017-10949

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Zero Day Initiative	Dell Storage Manager	2016 R2.1

References

http://topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdfRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/100138Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-523Third Party Advisory, VDB Entry
http://topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdfRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/100138Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-523Third Party Advisory, VDB Entry

Timeline

Published: Aug 4, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-109507.0This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Bitdefender Total Security 21.0.24.62. An CVE-2017-109518.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interacti CVE-2017-109528.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051. User interactio CVE-2017-109538.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interacti CVE-2017-109548.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet S CVE-2017-109558.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection Advisor 6.3.0. Authe CVE-2017-109566.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User i CVE-2017-109578.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interacti CVE-2017-109588.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interacti CVE-2017-109598.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interacti CVE-2017-10965.4IBM Jazz Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS CVE-2017-109618.8REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components.