Description
Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload(). An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP agent is installed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arcserve | Arcserve UDP | < 9.2 | 9.2 |
Advisories 1
- WID-SEC-2023-3031 Arcserve Unified Data Protection: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 30, 2023