CVE-2011-4135: flexerasoftware flexnet_publisher Path Traversal

Vulnerability summary

CVE-2011-4135 is a high (CVSS 10.0) Path Traversal vulnerability in flexerasoftware flexnet_publisher. EPSS estimates a 30.17% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-01-2012
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files. NOTE: this might overlap CVE-2011-1389.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.