CVE-2007-5005 json
Directory traversal vulnerability in rxRPC.dll in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 throug…
published 2007-10-01 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-4986
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.2%
- EPSS 5.2% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
Directory traversal vulnerability in rxRPC.dll in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allows remote attackers to upload and overwrite arbitrary files via a ..\ (dot dot backslash) sequence in the destination filename argument to sub-function 8 in the rxrReceiveFileFromServer command.
Patch / fix
Exploit prediction
5.24% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
secunia.com
/advisories/25606
third-party-advisory, patch, vendor-advisory
-
ca.com
/us/securityadvisor/newsinfo/collateral.aspx?cid=156006
patch
-
ca.com
/us/securityadvisor/vulninfo/vuln.aspx?id=35676
patch
-
supportconnectw.ca.com
/public/sams/lifeguard/infodocs/caarcservebld-securitynotice.asp
patch
-
securityfocus.com
/bid/24348
vdb-entry
-
securityfocus.com
/archive/1/480252/100/100/threaded
mailing-list
-
research.eeye.com
/html/advisories/published/AD20070920.html
third-party-advisory
-
securitytracker.com
/id?1018728
vdb-entry
Sources
- CVE List CVE-2007-5005
- NVD CVE-2007-5005
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.