CVE-2013-5486
Last modified
CVE-2013-5486 is a vulnerability of currently unknown severity. Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.. EPSS estimates a 75.96% chance of exploitation in the next 30 days.
Description
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Prime Data Center Network Manager | 4.1\(2\) |
| Cisco | Prime Data Center Network Manager | 4.1\(3\) |
| Cisco | Prime Data Center Network Manager | 4.1\(4\) |
| Cisco | Prime Data Center Network Manager | 4.1\(5\) |
| Cisco | Prime Data Center Network Manager | 4.2\(1\) |
| Cisco | Prime Data Center Network Manager | 4.2\(3\) |
| Cisco | Prime Data Center Network Manager | 5.0\(2\) |
| Cisco | Prime Data Center Network Manager | 5.0\(3\) |
| Cisco | Prime Data Center Network Manager | 5.1\(1\) |
| Cisco | Prime Data Center Network Manager | 5.1\(2\) |
| Cisco | Prime Data Center Network Manager | 5.1\(3u\) |
| Cisco | Prime Data Center Network Manager | 5.2\(2\) |
| Cisco | Prime Data Center Network Manager | 5.2\(2a\) |
| Cisco | Prime Data Center Network Manager | 5.2\(2b\) |
| Cisco | Prime Data Center Network Manager | 5.2\(2c\) |
| Cisco | Prime Data Center Network Manager | 5.2\(2e\) |
| Cisco | Prime Data Center Network Manager | 6.1\(1a\) |
| Cisco | Prime Data Center Network Manager | 6.1\(1b\) |
| Cisco | Prime Data Center Network Manager | <= 6.1\(1b\) |
References
- http://www.exploit-db.com/exploits/30008Exploit, Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/30008Exploit, Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-5486?
How severe is CVE-2013-5486?
How do I fix CVE-2013-5486?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-5478Cisco IOS 15.0 through 15.3 and IOS XE 3.2 through 3.8, when…
- CVE-2013-5479The DNS-over-TCP implementation in Cisco IOS 12.2 and 15.0 t…
- CVE-2013-5480The DNS-over-TCP implementation in Cisco IOS 12.2 and 15.0 t…
- CVE-2013-5481The PPTP implementation in Cisco IOS 12.2 and 15.0 through 1…
- CVE-2013-5482Cisco Prime LAN Management Solution (LMS) does not properly …
- CVE-2013-5483Cross-site scripting (XSS) vulnerability in bookmarklet.jsp …
- CVE-2013-5487DCNM-SAN Server in Cisco Prime Data Center Network Manager (…
- CVE-2013-5488Cisco Common Services, as used in Cisco Prime LAN Management…
- CVE-2013-5489The gadget implementation in Cisco SocialMiner does not prop…
- CVE-2013-5490Cisco Prime Data Center Network Manager (DCNM) before 6.2(1)…
- CVE-2013-5492administration.jsp in Cisco SocialMiner allows remote attack…
- CVE-2013-5493The diagnostic module in the firmware on Cisco Virtualizatio…
Are you affected by CVE-2013-5486?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST