CVE-2011-0497

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-01-20 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to read arbitrary files via "../\" (dot dot forward-slash backslash) sequences in a crafted request.

Affected products

Sybase Appeon For Powerbuilder: 2.5, 2.6, 2.7, 2.8, 6.0, 6.1 (+2)
Sybase Easerver: 5.0, 5.0.1, 5.1, 5.2, 5.2.1, 5.3 (+7)
Sybase Replication Server: 15.2
Sybase Workspace: 1.0, 1.5, 1.6, 1.7, 2.0, 2.0.1 (+4)

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=889
http://osvdb.org/70427
http://secunia.com/advisories/42904
http://www.securityfocus.com/bid/45809
http://www.sybase.com/detail?id=1091057
http://www.vupen.com/english/advisories/2011/0125
https://exchange.xforce.ibmcloud.com/vulnerabilities/64695
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=889
http://osvdb.org/70427
http://secunia.com/advisories/42904
http://www.securityfocus.com/bid/45809
http://www.sybase.com/detail?id=1091057

Get alerted when CVE-2011-0497 or the next vulnerability affects your stack