Path Traversal in IBM Director
CVE-2009-0880
Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.316 (98.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.316 · newest: 0.316 · change: 0.000
Affected products
- IBM Director — versions 3.1.1, 4.10, 4.11
- Microsoft Windows
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.vupen.com/english/advisories/2009/0656 (Patch, vdb-entry, Vendor Advisory)
- osvdb.org/52616 (vdb-entry)
- www.securityfocus.com/archive/1/501639/100/0/threaded (mailing-list)
- www.securityfocus.com/bid/34065 (vdb-entry)
- www.sec-consult.com/files/20090305-2_IBM_director_privilege_escalation.txt (Exploit)
- secunia.com/advisories/34212 (Vendor Advisory, third-party-advisory)
- www14.software.ibm.com/webapp/iwm/web/reg/download.do (Patch, Vendor Advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/49286 (vdb-entry)
Frequently asked questions
- What is CVE-2009-0880?
- CVE-2009-0880 is a vulnerability in IBM Director, classified under Path Traversal. Published 2009-03-12.
- Is CVE-2009-0880 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.