CVE-2009-3693

high · 9.3

Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. (backwards slash dot dot) sequences in the third argument to the MakeHttpRequest method.

9.3

CVSS

41.6%

EPSS (exploit prob.)

99th

EPSS percentile

2009-10-13

Published

AV:N/AC:M/Au:N/C:C/I:C/A:C

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
persits	xupload	2.0
hp	loadrunner	9.5

Check a specific version with /api/v1/cve/match.

References

http://retrogod.altervista.org/9sg_hp_loadrunner.html
http://secunia.com/advisories/36898
http://retrogod.altervista.org/9sg_hp_loadrunner.html
http://secunia.com/advisories/36898

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-3693