Novell Sentinel Log Manager versions 1.2.0.1 and below suffer from a directory traversal vulnerability.
1344d9e53b9e1f29ca58152d68c7e31e2e1f7554e18481c4fbb9c5c8437f755c
**************************************************************
Vuln: Path Traversal
Application: Sentinel Log Manager
Vendor: Novell
Version affected: <= 1.2.0.1
Website: http://www.novell.com/products/sentinel-log-manager/
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi@gmail.com
Web: http://www.andreafabrizi.it
**************************************************************
The latest version of Sentinel Log Manager is prone to a Directory
Traversal, which makes it possible, for Authenticated Users, to access
any system file.
Testing environment: Sentinel Log Manager Appliance 1.2.0.1
Vulnerable URL:
/novelllogmanager/FileDownload?filename=/opt/novell/sentinel_log_mgr/3rdparty/tomcat/temp/../../../../../../etc/passwd