CVE-2011-1654 in the critical feed json
Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defen…
published 2011-04-15 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1654
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 11.4%
- EPSS 11.4% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense (TD) r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to FileUploadHandler.ashx.
Exploit prediction
11.42% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
secunia.com
/advisories/44097
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2011/0977
vdb-entry, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/66726
vdb-entry
-
securitytracker.com
/id?1025353
vdb-entry
- support.ca.com /irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D
-
securityfocus.com
/bid/47357
vdb-entry
-
securityfocus.com
/archive/1/517488/100/0/threaded
mailing-list
- zerodayinitiative.com /advisories/ZDI-11-126/
-
securityfocus.com
/archive/1/517494/100/0/threaded
mailing-list
Sources
- CVE List CVE-2011-1654
- NVD CVE-2011-1654
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.