CVE-2008-0457

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 12%

from disclosure to weapon0 days

Published on NVDFeb 7

1st PoCJan 5

exploitation probability

12%top 4% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/5078unverified exploitdbwww.exploit-db.com/exploits/31072unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/28787 http://seer.entsupport.symantec.com/docs/297171.htm https://www.exploit-db.com/exploits/5078 http://www.securityfocus.com/archive/1/487688/100/0/threaded http://www.securityfocus.com/bid/27487 http://www.securitytracker.com/id?1019303 http://www.symantec.com/avcenter/security/Content/2008.02.04.html http://www.vupen.com/english/advisories/2008/0413 http://www.zerodayinitiative.com/advisories/ZDI-08-003.html