CVE-2015-0779
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management ...
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323 and CVE-2010-5324.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323 and CVE-2010-5324.
- Record
CVE-2015-0779- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323 and CVE-2010-5324.
- Record
CVE-2015-0779- Updated
- 2026-11-02
EUVDEUVD-2015-0792 No score
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323 and CVE-2010-5324.
- Record
EUVD-2015-0792- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-49r7-w8p8-xgc3 No score
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management ...
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323 and CVE-2010-5324.
- Record
GHSA-49r7-w8p8-xgc3- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Novell ZENworks Configuration Management 11.3.1 - Remote Code Execution | 2015-04-08 |
| Exploit-DB | Novell ZENworks Configuration Management - Arbitrary File Upload (Metasploit) | 2015-05-08 |
| Metasploit | Novell ZENworks Configuration Management Arbitrary File Upload | 2015-04-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0779 is a high vulnerability (CVSS 10.0) in Novell Zenworks Configuration Management, published June 7, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.4%, the 99th percentile. No source names a fixed version.
References
github.com/rapid7/metasploit-framework/pull/5096
exploit-db.com/exploits/36964
novell.com/support/kb/doc.php?id=7016419
raw.githubusercontent.com/pedrib/PoC/master/generic/zenworks_zcm_rce.txt
seclists.org/fulldisclosure/2015/Apr/21
nvd.nist.gov/vuln/detail/CVE-2015-0779