CVE-2013-0136

high · 8.5

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.

8.5

CVSS

40.3%

EPSS (exploit prob.)

99th

EPSS percentile

2013-06-01

Published

AV:N/AC:M/Au:S/C:C/I:C/A:C

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
mutiny	mutiny	<= 5.0-1.10
mutiny	mutiny	5.0-1.00
mutiny	mutiny_virtual_appliance	all versions
mutiny	mutiny_appliance	all versions

Check a specific version with /api/v1/cve/match.

References

http://www.kb.cert.org/vuls/id/701572
https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities
http://www.kb.cert.org/vuls/id/701572
https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-0136