Novell ZENworks Mobile Management "language" File Inclusion Vulnerabilities
Description
Two vulnerabilities have been reported in Novell ZENworks Mobile Management, which can be exploited by malicious people to disclose certain sensitive information.
Input passed via the "language" parameter to MDM.php and DUSAP.php is not properly verified before being used to include files. This can be exploited to include arbitrary files via directory traversal sequences.
The vulnerabilities are reported in versions 2.6.0, 2.6.1, and 2.7.0.
Vulnerable Products
Vulnerable Software: Novell ZENworks Mobile Management 2.x
