CVE-2011-2474: Sybase EAServer HTTP Server directory traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote file read with a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.

What it is

The HTTP Server component in Sybase EAServer 6.3.1 Developer Edition is vulnerable to directory traversal. A crafted path using a /.\../\../\ sequence lets a remote attacker read files outside the intended web root. The record names only the Developer Edition of 6.3.1, so other versions and editions are not confirmed as affected.

Impact

An unauthenticated remote attacker can read arbitrary files on the server, exposing configuration, credentials or other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network through the EAServer HTTP Server; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The attacker only needs to send a crafted traversal path in an HTTP request.

Exploitation

Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is high at 0.636 probability (99th percentile), suggesting meaningful exploitation likelihood. The record does not confirm public exploit code.

What to do

• Apply the vendor patch or upgrade from the affected Sybase EAServer 6.3.1 Developer Edition build.
• If patching is not possible, restrict network access to the EAServer HTTP listener to trusted hosts.
• Normalize and reject path sequences containing backslashes or ../ patterns at the web server or reverse proxy layer.
• Run the service with least privilege and limit filesystem permissions so traversal reads expose minimal data.

Detection

• Search HTTP access logs for requests containing /.\../ or backslash traversal sequences.
• Alert on HTTP requests with encoded or mixed-separator traversal patterns targeting the EAServer listener.
• Monitor for unexpected reads of configuration or credential files by the EAServer process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.