What is the CVSS score of CVE-2013-0136?

CVE-2013-0136 has a CVSS 2.0 base score of 8.5 (High). CVSS vector: AV:N/AC:M/Au:S/C:C/I:C/A:C. EPSS exploitation probability: 72.1%.

Is there a public PoC exploit available for CVE-2013-0136?

Yes, a public proof-of-concept exploit is available for CVE-2013-0136. Prioritise patching immediately. EPSS: 72.1%.

Mutiny CVE-2013-0136

HIGH

Path Traversal (CWE-22)

2013-06-01 cret@cert.org

Denial Of Service Path Traversal Mutiny Mutiny Virtual Appliance Mutiny Appliance

8.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:M/Au:S/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:S/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jun 01, 2013 - 14:21 cve.org

HIGH 8.5

DescriptionCVE.org

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.

AnalysisAI

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 72.1%.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation. Affected products include: Mutiny, Mutiny Mutiny Virtual Appliance, Mutiny Mutiny Appliance. Version information: before 5.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.