Path Traversal in IBM Rational License Key Server
CVE-2011-1389
Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files. NOTE: this might overlap CVE-2011-4135.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.068 (93.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 93.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.072 · newest: 0.068 · change: -0.004
Affected products
- IBM Rational License Key Server — versions 8.0, 8.1, 8.1.1
- IBM Rational License Server — versions 7.0, 7.1, 7.5
- IBM Telelogic License Server — versions 2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.flexerasoftware.com/pl/13057.htm
- secunia.com/advisories/47524 (Vendor Advisory, third-party-advisory)
- kb.flexerasoftware.com/selfservice/microsites/search.do
- www.zerodayinitiative.com/advisories/ZDI-11-272/
- secunia.com/advisories/47522 (Vendor Advisory, third-party-advisory)
- www.securityfocus.com/bid/49191 (vdb-entry)
- www.ibm.com/support/docview.wss (Patch, Vendor Advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/71739 (vdb-entry)
Frequently asked questions
- What is CVE-2011-1389?
- CVE-2011-1389 is a vulnerability in IBM Rational License Key Server, classified under Path Traversal. Published 2012-01-19.
- Is CVE-2011-1389 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.