{"schemaVersion":3,"id":"CVE-2011-1654","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense (TD) r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to FileUploadHandler.ashx.","dates":{"published":"2011-04-15T19:00:00.000Z","modified":"2024-08-06T22:37:25.501Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.11423,"percentile":0.95971,"severity":"medium","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.11423},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.11423,"percentile":0.95971}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.11423,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.11423,"percentile":0.95971}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"broadcom","product":"total_defense","name":"total defense","label":"total_defense","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"r12","eol":null,"hubHref":"/vendor/broadcom/total_defense"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://secunia.com/advisories/44097","label":"secunia.com/advisories/44097","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66726","label":"exchange.xforce.ibmcloud.com/vulnerabilities/66726","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.vupen.com/english/advisories/2011/0977","label":"www.vupen.com/english/advisories/2011/0977","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1025353","label":"securitytracker.com/id?1025353","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D","label":"support.ca.com/irj/…","hostname":"support.ca.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.securityfocus.com/bid/47357","label":"www.securityfocus.com/bid/47357","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.securityfocus.com/archive/1/517488/100/0/threaded","label":"www.securityfocus.com/archive/1/517488/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-126/","label":"www.zerodayinitiative.com/advisories/ZDI-11-126/","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC"]},{"url":"http://www.securityfocus.com/archive/1/517494/100/0/threaded","label":"www.securityfocus.com/archive/1/517494/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2011-04-15T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T22:37:25.501Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:23:38.133Z","stale":false,"partial":false}}