Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade openwsman-pythonUpgrade openwsman-debuginfoUpgrade openwsman-perlUpgrade openwsman-rubyUpgrade libwsman-develUpgrade openwsman-clientUpgrade openwsman-serverUpgrade libwsman1 | Apr 27, 2020 | Mar 14, 2019 |
| Centos_linux | — | Upgrade openwsman-server-debuginfoUpgrade openwsman-perl-debuginfoUpgrade openwsman-rubyUpgrade openwsman-clientUpgrade rubygem-openwsman-debuginfoUpgrade openwsman-serverUpgrade openwsman-pythonUpgrade openwsman-python3Upgrade libwsman1Upgrade openwsman-debugsourceUpgrade openwsman-perlUpgrade libwsman-develUpgrade libwsman1-debuginfoUpgrade openwsman-debuginfoUpgrade openwsman-python3-debuginfoUpgrade openwsman-client-debuginfo | May 1, 2019 | Mar 14, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libwsman1Upgrade openwsman-serverUpgrade openwsman-client | May 7, 2019 | Mar 14, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade openwsman-serverUpgrade openwsman-clientUpgrade libwsman1 | May 7, 2019 | Mar 14, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libwsman1Upgrade openwsman-serverUpgrade openwsman-pythonUpgrade openwsman-client | May 7, 2019 | Mar 14, 2019 |
| Oracle_linux | — | Upgrade openwsman-clientUpgrade openwsman-rubyUpgrade openwsman-serverUpgrade libwsman-develUpgrade openwsman-python3Upgrade openwsman-perlUpgrade libwsman1Upgrade openwsman-python | Jul 21, 2020 | Mar 12, 2019 |
| Redhat_linux | — | Upgrade openwsman-serverNo solution existsUpgrade libwsman1-debuginfoUpgrade openwsman-debuginfoUpgrade libwsman-develUpgrade openwsman-clientUpgrade rubygem-openwsman-debuginfoUpgrade openwsman-debugsourceUpgrade openwsman-client-debuginfoUpgrade openwsman-server-debuginfoUpgrade openwsman-perl-debuginfoUpgrade openwsman-python3-debuginfoUpgrade openwsman-python3Upgrade libwsman1 | Mar 27, 2019 | Mar 14, 2019 |
| Suse | — | Upgrade openwsman-pythonUpgrade libwsman_clientpp1Upgrade libwsman-develUpgrade openwsman-perlUpgrade python3-openwsmanUpgrade libwsman_clientpp-develUpgrade openwsman-ruby-docsUpgrade openwsman-server-plugin-rubyUpgrade openwsman-javaUpgrade libwsman3Upgrade openwsman-clientUpgrade openwsman-rubyUpgrade libwsman1Upgrade openwsman-serverUpgrade winrs | Mar 19, 2019 | Mar 14, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 14, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub