Path Traversal in Mutiny
CVE-2013-0136
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.403 (98.5th percentile) — read the EPSS interpretation.
Affected products
- Mutiny — versions 5.0-1.00
- Mutiny Mutiny_appliance
- Mutiny Mutiny_virtual_appliance
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cret@cert.org (Exploit, x_refsource_MISC)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
Frequently asked questions
- What is CVE-2013-0136?
- CVE-2013-0136 is a vulnerability in Mutiny, classified under Path Traversal. Published 2013-06-01.
- Is CVE-2013-0136 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.