BMC Dashboards for BSM contains a bundled version of Adobe BlazeDS which has a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../). This directory traversal attack would allow the attacker to access arbitrary files and upload arbitrary files.

OSVDB is not aware of a solution for this vulnerability.

• Secunia Advisory ID: 44561
• Related OSVDB ID: 72371 72372 72373 72375
• Mail List Post: http://seclists.org/fulldisclosure/2011/May/137
• Vendor URL: http://www.bmc.com/
• Other Advisory URL: http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-18

• Richard Brain - ProCheckUp
• Jan Fry - ProCheckUp

NVD does not currently have a CVSSv2 score assigned.