{"schemaVersion":3,"id":"CVE-2017-10949","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459.","dates":{"published":"2017-08-04T15:00:00.000Z","modified":"2024-09-16T23:15:55.612Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.054,"percentile":0.92608,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.054},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04656,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.054,"percentile":0.92608}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04656,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.054,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.054,"percentile":0.92608}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"dell","product":"storage_manager_2016","name":"storage manager 2016","label":"storage_manager_2016","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"r2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"r2.1","eol":null,"hubHref":"/vendor/dell/storage_manager_2016"},{"vendor":"zero day initiative","product":"dell storage manager","name":"Dell Storage Manager","label":"dell storage manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016 R2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016 R2.1","eol":null,"hubHref":"/vendor/zero_day_initiative/dell_storage_manager"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdf","label":"topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdf","hostname":"topics-cdn.dell.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-17-523","label":"www.zerodayinitiative.com/advisories/ZDI-17-523","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/100138","label":"www.securityfocus.com/bid/100138","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-08-04T15:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T23:15:55.612Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:54:56.214Z","stale":false,"partial":false}}