What is CVE-2009-3693?

CVE-2009-3693 is a vulnerability in HP Loadrunner, classified under Path Traversal. Published 2009-10-13.

Is CVE-2009-3693 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in HP Loadrunner

CVE-2009-3693

Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. (backwards slash dot dot) sequences in the third argument to the MakeHttpRequest method.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.416 (98.5th percentile) — read the EPSS interpretation.

Affected products

Hp Loadrunner — versions 9.5
Persits Xupload — versions 2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

References

cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
cve@mitre.org (Exploit, x_refsource_MISC)

Frequently asked questions

What is CVE-2009-3693?: CVE-2009-3693 is a vulnerability in HP Loadrunner, classified under Path Traversal. Published 2009-10-13.
Is CVE-2009-3693 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.