CVE-2015-0779 — AI Deep Analysis Summary

🚨 **Essence**: A Directory Traversal flaw in Novell ZCM's `UploadServlet`. 📉 **Consequences**: Attackers can upload malicious WAR files to execute arbitrary code on the server.…

🛠️ **Root Cause**: Improper input validation in the `UploadServlet`. 📂 **Flaw**: The system fails to sanitize the `type` parameter (directory name) and `filename` parameter (WAR file name).…

🏢 **Vendor**: Novell (Micro Focus). 📦 **Product**: ZENworks Configuration Management (ZCM). 📅 **Affected Versions**: Version 10 and Version 11.3.2 (and earlier 11.x versions). 🎯

👑 **Privileges**: Remote Code Execution (RCE). 📂 **Data**: Full control over the server process running ZCM.…

🔓 **Auth**: Likely requires authentication to access the management interface, but the vulnerability is in the upload mechanism.…

🔥 **Public Exp**: YES. 📜 **Sources**: Exploit-DB (ID 36964), Metasploit Framework pull request, and public mailing list disclosures. 🌐 **Status**: Active exploitation tools and PoCs are available online. ⚡

🔍 **Check**: Scan for Novell ZCM servers. 📡 **Feature**: Look for the `UploadServlet` endpoint.…

🛡️ **Fixed**: YES. 📄 **Official**: Novell released a security advisory (KB doc 7016419). ✅ **Action**: Users must update ZCM to the patched version to resolve the issue. 🔄

🚧 **Workaround**: If patching is delayed, restrict network access to the ZCM management interface.…

🚨 **Urgency**: HIGH. 📅 **Published**: June 2015. ⚖️ **Risk**: RCE allows complete system compromise. 🏃 **Advice**: Patch immediately. Do not leave ZCM servers exposed to the internet without this fix. 🏃‍♂️