Log in Start free

Actively exploited · Published May 29, 2015 · Assigned by mitre

CVE-2015-4068

Critical 9.1 Exploited

In plain English

A critical-severity path traversal in Unified Data Protection (UDP) from Arcserve. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 63.6% (higher than 99.2% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)63.6%top 0.8% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References