Vulnerability record · CVE-2010-5324 · published 7 June 2015
CVE-2010-5324: Novell ZENworks Configuration Management UploadServlet path traversal RCE
Novell · Zenworks Configuration Management
UploadServlet in the Remote Management component of Novell ZENworks Configuration Management 10 before 10.3 is vulnerable to directory traversal via a crafted directory name in the type parameter of a zenworks-fileupload request. Combined with a WAR filename and WAR content in the POST data, this lets an unauthenticated remote attacker write and execute arbitrary code. It is distinct from CVE-2010-5323.
Description
Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated network-reachable path traversal leading to remote code execution with a CVSS base score of 10 and public exploit references.
What it is
UploadServlet in the Remote Management component of Novell ZENworks Configuration Management 10 before 10.3 is vulnerable to directory traversal via a crafted directory name in the type parameter of a zenworks-fileupload request. Combined with a WAR filename and WAR content in the POST data, this lets an unauthenticated remote attacker write and execute arbitrary code. It is distinct from CVE-2010-5323.
Impact
An attacker can write attacker-controlled WAR content to a traversed path and execute arbitrary code on the ZCM server, gaining full control of the host and its managed data.
Attack surface
Reachable over the network through the Remote Management UploadServlet via a crafted zenworks-fileupload request; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.72012 (99.4th percentile) and public references are tagged Exploit, indicating exploit code is publicly available and exploitation is likely.
What to do
- Upgrade Novell ZENworks Configuration Management to 10.3 or later per the vendor advisory (KB 7005573).
- If upgrade is not immediately possible, restrict network access to the Remote Management UploadServlet and the ZCM management interfaces to trusted hosts only.
- Disable or block the Remote Management upload functionality until patched.
- Monitor and restrict outbound and inbound traffic to the ZCM server to reduce exposure of the upload endpoint.
Detection
- Inspect web/proxy logs for zenworks-fileupload requests containing traversal sequences (../) in the type parameter.
- Alert on POST requests to UploadServlet with WAR filenames or WAR content in the body.
- Monitor the ZCM server filesystem for unexpected WAR files or new web application deployments.
- Review process creation and file writes on the ZCM host for activity originating from the web server process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-5324 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-5324), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
