{"schemaVersion":3,"id":"CVE-2006-4013","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple directory traversal vulnerabilities in Symantec Brightmail AntiSpam (SBAS) before 6.0.4, when the Control Center is allowed to connect from any computer, allow remote attackers to read and overwrite certain files via directory traversal sequences in (1) DATABLOB-GET and (2) DATABLOB-SAVE requests.","dates":{"published":"2006-08-07T19:00:00.000Z","modified":"2024-08-07T18:57:46.016Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.6,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.6,"severity":"high","vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04536,"percentile":0.91458,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.04536},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04536,"percentile":0.91458}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04536,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04536,"percentile":0.91458}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"symantec","product":"brightmail_antispam","name":"brightmail antispam","label":"brightmail_antispam","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.0","noFixRecorded":false,"fixedIn":null},{"text":"5.5","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0 | 5.5 | 6.0 | 6.0.1","eol":null,"hubHref":"/vendor/symantec/brightmail_antispam"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://securitytracker.com/id?1016600","label":"securitytracker.com/id?1016600","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Patch"]},{"url":"http://www.osvdb.org/27590","label":"www.osvdb.org/27590","hostname":"www.osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://www.securityfocus.com/bid/19182","label":"www.securityfocus.com/bid/19182","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.osvdb.org/27589","label":"www.osvdb.org/27589","hostname":"www.osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://securityresponse.symantec.com/avcenter/security/Content/2006.07.27.html","label":"securityresponse.symantec.com/avcenter/security/Content/2006.07.27.html","hostname":"securityresponse.symantec.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2006/3018","label":"www.vupen.com/english/advisories/2006/3018","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28058","label":"exchange.xforce.ibmcloud.com/vulnerabilities/28058","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28059","label":"exchange.xforce.ibmcloud.com/vulnerabilities/28059","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://secunia.com/advisories/21223","label":"secunia.com/advisories/21223","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2006-08-07T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T18:57:46.016Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T23:43:11.511Z","stale":false,"partial":false}}