CVE-2011-1654

Name of the Vulnerable Software and Affected Versions CA Total Defense versions prior to r12 SE2

Description A directory traversal issue exists in the Heartbeat Web Service, allowing remote attackers to execute arbitrary code. This is achieved by using directory traversal sequences in the GUID parameter within an upload request to the "FileUploadHandler.ashx" endpoint.

Recommendations For versions prior to r12 SE2, update to r12 SE2 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileUploadHandler.ashx endpoint to minimize the risk of exploitation. Avoid using the GUID parameter in the affected endpoint until the issue is resolved.