CVE-2008-2241

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-05-21 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allows remote attackers to append arbitrary data to arbitrary files via directory traversal sequences in unspecified input fields, which are used in log messages. NOTE: this can be leveraged for code execution in many installation environments by writing to a startup file or configuration file.

Affected products

Broadcom Brightstor Arcserve Backup: 11.1, 11.5
Broadcom Server Protection Suite: 2
Ca Brightstor Arcserve Backup: 11.0, r11.0
Ca Business Protection Suite: 2.0

References

http://secunia.com/advisories/30300
http://www.securityfocus.com/archive/1/492266/100/0/threaded
http://www.securityfocus.com/archive/1/492274/100/0/threaded
http://www.securityfocus.com/bid/29283
http://www.securitytracker.com/id?1020043
http://www.vupen.com/english/advisories/2008/1573/references
http://www.zerodayinitiative.com/advisories/ZDI-08-027/
https://exchange.xforce.ibmcloud.com/vulnerabilities/42524
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=176798
http://secunia.com/advisories/30300
http://www.securityfocus.com/archive/1/492266/100/0/threaded
http://www.securityfocus.com/archive/1/492274/100/0/threaded

Get alerted when CVE-2008-2241 or the next vulnerability affects your stack