« Volver al listado

CVE-2014-3914

Estado: ModificadaAlta (10)—

Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet, (4) read arbitrary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups action to the userRequest servlet, or (6) delete arbitrary files via a del action in the fileRequestServlet servlet.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rocketsoftware — Rocket Servergraph

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3914",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-08-07T11:13:36.157",
  "references": [
    {
      "url": "http://www.exploit-db.com/exploits/33807",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-161/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-162/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-163/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-165/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-166/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/33807",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-161/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-162/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-163/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-165/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-166/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet, (4) read arbitrary files via a readDataFile action to the fileRequestor servlet, (5) execute arbitrary code via a save_server_groups action to the userRequest servlet, or (6) delete arbitrary files via a del action in the fileRequestServlet servlet."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en el centro de administración para Tivoli Storage Manager (TSM) en Rocket ServerGraph 1.2 permite a atacantes remotos (1) crear ficheros arbitrarios a través de un .. (punto punto) en el parámetro query en una acción writeDataFile en el servlet fileRequestor, ejecutar ficheros arbitrarios a través de un .. (punto punto) en el parámetro query en una acción (2) run o (3) runClear en el servlet fileRequestor, (4) leer ficheros arbitrarios a través de una acción readDataFile en el servlet fileRequestor, (5) ejecutar código arbitrario a través de una acción save_server_groups en el servlet userRequest o (6) eliminar ficheros arbitrarios a través de una acción del en el servlet fileRequestServlet."
    }
  ],
  "lastModified": "2026-06-17T00:09:07.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rocketsoftware:rocket_servergraph:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB684E8A-7034-445D-81B4-7DAD1CA5E13E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}