CVE-2013-7091 in Telligent Systems Zimbra

Summary

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Reservation

12/13/2013

Disclosure

12/13/2013

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
65749	Telligent Systems Zimbra path traversal	22	High	Not defined	CVE-2013-7091
11439	VMware Zimbra Collaboration Suite Ajx%20TemplateMsg.js.zgz path traversal	22	High	Not defined	CVE-2013-7091

Sources

• MITRE
• NVD
• CVE Details