{"schemaVersion":3,"id":"CVE-2008-0068","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary files via directory traversal sequences in the Action parameter.","dates":{"published":"2008-04-16T18:00:00.000Z","modified":"2024-08-07T07:32:23.916Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.05088,"percentile":0.9231,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.05088},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.05088,"percentile":0.9231}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05088,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.05088,"percentile":0.9231}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_6822CEEB87113BD2","name":"Exploit Reference (securityfocus.com)","source":"reference","url":"http://www.securityfocus.com/bid/28745","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_E8400A742B17E8D3","name":"Exploit Reference (aluigi.altervista.org)","source":"reference","url":"http://aluigi.altervista.org/adv/closedviewx-adv.txt","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"31638","name":"HP OpenView Network Node Manager (OV NNM) 7.x - 'OpenView5.exe?Action' Traversal Arbitrary File Access","source":"exploit-database","url":"https://www.exploit-db.com/exploits/31638","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/31638.txt","codes":["CVE-2008-0068","OSVDB-44359"]},"metasploit":null}],"exploitCount":3,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"hp","product":"openview_network_node_manager","name":"openview network node manager","label":"openview_network_node_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.51","noFixRecorded":false,"fixedIn":null},{"text":"7.53","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.51 | 7.53","eol":null,"hubHref":"/vendor/hp/openview_network_node_manager"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id?1019839","label":"www.securitytracker.com/id?1019839","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41790","label":"exchange.xforce.ibmcloud.com/vulnerabilities/41790","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://secunia.com/advisories/29796","label":"secunia.com/advisories/29796","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/490834/100/0/threaded","label":"www.securityfocus.com/archive/1/490834/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://secunia.com/secunia_research/2008-4/advisory/","label":"secunia.com/secunia_research/2008-4/advisory/","hostname":"secunia.com","tags":["X Refsource MISC"]},{"url":"http://securityreason.com/securityalert/3814","label":"securityreason.com/securityalert/3814","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://www.securityfocus.com/bid/28745","label":"www.securityfocus.com/bid/28745","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Exploit"]},{"url":"http://marc.info/?l=bugtraq&m=121553649611253&w=2","label":"marc.info?l=bugtraq&m=121553649611253&w=2","hostname":"marc.info","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://www.osvdb.org/44359","label":"www.osvdb.org/44359","hostname":"www.osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://www.securityfocus.com/archive/1/490771","label":"www.securityfocus.com/archive/1/490771","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.vupen.com/english/advisories/2008/1214/references","label":"www.vupen.com/english/advisories/2008/1214/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.securitytracker.com/id?1019838","label":"www.securitytracker.com/id?1019838","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://aluigi.altervista.org/adv/closedviewx-adv.txt","label":"aluigi.altervista.org/adv/closedviewx-adv.txt","hostname":"aluigi.altervista.org","tags":["X Refsource MISC","Exploit"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-04-16T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T07:32:23.916Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T22:18:29.965Z","stale":false,"partial":false}}