CVE-2016-1610 describes a directory traversal vulnerability in Novell Filr versions prior to 1.2 Security Update 3 and 2.0 prior to Security Update 2. This flaw allows remote attackers to bypass access restrictions and write to arbitrary files by manipulating blob names with “..” sequences within the email-template feature. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network without authentication, leading to high integrity impact (arbitrary file write) but no confidentiality or availability impact. While not listed on CISA's KEV catalog, an ExploitDB entry exists, and the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.2CPE matchmatch criteria | cpe:2.3:a:novell:filr:*:security_update_2:*:*:*:*:*:* | ||
<= 2.0CPE matchmatch criteria | cpe:2.3:a:novell:filr:*:security_update_1:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.