Common Weakness Enumeration
CWE-23
AllowedRelative Path Traversal
Abstraction: Base · Status: Draft
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
840 vulnerabilities reference this CWE, most recent first.
CVE-2024-22415 (GCVE-0-2024-22415)
Vulnerability from cvelistv5 – Published: 2024-01-18 20:27 – Updated: 2024-09-10 20:44
VLAI
EPSS
VEX
Title
Unsecured endpoints in the jupyter-lsp server extension
Summary
jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. This issue has been patched in version 2.2.2 and all users are advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 20:42 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/jupyter-lsp/jupyterlab-lsp/sec… | x_refsource_CONFIRM |
| https://github.com/jupyter-lsp/jupyterlab-lsp/com… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jupyter-lsp | jupyterlab-lsp |
Affected:
< 2.2.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:43:34.913Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x"
},
{
"name": "https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22415",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T20:42:53.589510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T20:44:01.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jupyterlab-lsp",
"vendor": "jupyter-lsp",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. This issue has been patched in version 2.2.2 and all users are advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-18T20:27:39.180Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x"
},
{
"name": "https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95"
}
],
"source": {
"advisory": "GHSA-4qhp-652w-c22x",
"discovery": "UNKNOWN"
},
"title": "Unsecured endpoints in the jupyter-lsp server extension"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-22415",
"datePublished": "2024-01-18T20:27:39.180Z",
"dateReserved": "2024-01-10T15:09:55.552Z",
"dateUpdated": "2024-09-10T20:44:01.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22226 (GCVE-0-2024-22226)
Vulnerability from cvelistv5 – Published: 2024-02-12 18:55 – Updated: 2024-08-01 22:43
VLAI
EPSS
VEX
Summary
Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-12 21:24 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.dell.com/support/kbdoc/en-us/00022201… | vendor-advisory |
Date Public
2024-02-12 06:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-12T21:24:49.394229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:52.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:43:33.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Unity",
"vendor": "Dell",
"versions": [
{
"lessThan": "5.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-02-12T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges.\u003c/span\u003e\n\n"
}
],
"value": "\nDell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-12T18:55:44.482Z",
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"assignerShortName": "dell",
"cveId": "CVE-2024-22226",
"datePublished": "2024-02-12T18:55:44.482Z",
"dateReserved": "2024-01-08T12:59:32.809Z",
"dateUpdated": "2024-08-01T22:43:33.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22096 (GCVE-0-2024-22096)
Vulnerability from cvelistv5 – Published: 2024-02-01 23:15 – Updated: 2025-05-09 19:00
VLAI
EPSS
VEX
Title
Relative Path Traversal in Rapid SCADA
Summary
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-09 18:59 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rapid Software LLC | Rapid SCADA |
Affected:
0 , ≤ 5.8.4
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:35:34.809Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03"
},
{
"tags": [
"x_transferred"
],
"url": "https://rapidscada.org/contact/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-09T18:59:49.208663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-09T19:00:04.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rapid SCADA",
"vendor": "Rapid Software LLC",
"versions": [
{
"lessThanOrEqual": "5.8.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Noam Moshe of Claroty Research reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Rapid Software LLC\u0027s Rapid SCADA versions prior to\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVersion 5.8.4,\u0026nbsp;an attacker can \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eappend path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "In Rapid Software LLC\u0027s Rapid SCADA versions prior to\u00a0Version 5.8.4,\u00a0an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-01T23:15:06.983Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03"
},
{
"url": "https://rapidscada.org/contact/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Relative Path Traversal in Rapid SCADA",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nRapid Software did not respond to CISA\u0027s attempts at coordination. Users\n of Rapid SCADA are encouraged to contact Rapid Software and keep their \nsystems up to date.\n\n\u003cbr\u003e"
}
],
"value": "Rapid Software did not respond to CISA\u0027s attempts at coordination. Users\n of Rapid SCADA are encouraged to contact Rapid Software and keep their \nsystems up to date.\n\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-22096",
"datePublished": "2024-02-01T23:15:06.983Z",
"dateReserved": "2024-01-05T21:39:05.410Z",
"dateUpdated": "2025-05-09T19:00:04.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20449 (GCVE-0-2024-20449)
Vulnerability from cvelistv5 – Published: 2024-10-02 16:54 – Updated: 2024-10-02 19:33
VLAI
EPSS
VEX
Title
Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability
Summary
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device.
This vulnerability is due to improper path validation. An attacker could exploit this vulnerability by using the Secure Copy Protocol (SCP) to upload malicious code to an affected device using path traversal techniques. A successful exploit could allow the attacker to execute arbitrary code in a specific container with the privileges of root.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-02 19:01 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Data Center Network Manager |
Affected:
12.1(1)
Affected: 12.0.1a Affected: 12.0.2d Affected: 12.0.2f Affected: 12.1.1 Affected: 12.1.1e Affected: 12.1.1p Affected: 12.1.2e Affected: 12.1.2p Affected: 12.1.3b Affected: 12.2.1 |
|
| cisco | data_center_network_manager |
Affected:
12.1(1)
Affected: 12.0.1a Affected: 12.0.2d Affected: 12.0.2f Affected: 12.1.1 Affected: 12.1.1e Affected: 12.1.1p Affected: 12.1.2e Affected: 12.1.2p Affected: 12.1.3b Affected: 12.2.1 cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "data_center_network_manager",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.1(1)"
},
{
"status": "affected",
"version": "12.0.1a"
},
{
"status": "affected",
"version": "12.0.2d"
},
{
"status": "affected",
"version": "12.0.2f"
},
{
"status": "affected",
"version": "12.1.1"
},
{
"status": "affected",
"version": "12.1.1e"
},
{
"status": "affected",
"version": "12.1.1p"
},
{
"status": "affected",
"version": "12.1.2e"
},
{
"status": "affected",
"version": "12.1.2p"
},
{
"status": "affected",
"version": "12.1.3b"
},
{
"status": "affected",
"version": "12.2.1"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-02T19:01:03.051565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T19:33:43.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Data Center Network Manager",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "12.1(1)"
},
{
"status": "affected",
"version": "12.0.1a"
},
{
"status": "affected",
"version": "12.0.2d"
},
{
"status": "affected",
"version": "12.0.2f"
},
{
"status": "affected",
"version": "12.1.1"
},
{
"status": "affected",
"version": "12.1.1e"
},
{
"status": "affected",
"version": "12.1.1p"
},
{
"status": "affected",
"version": "12.1.2e"
},
{
"status": "affected",
"version": "12.1.2p"
},
{
"status": "affected",
"version": "12.1.3b"
},
{
"status": "affected",
"version": "12.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device.\r\n\r\nThis vulnerability is due to improper path validation. An attacker could exploit this vulnerability by using the Secure Copy Protocol (SCP) to upload malicious code to an affected device using path traversal techniques. A successful exploit could allow the attacker to execute arbitrary\u0026nbsp;code in a specific container with the privileges of root."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "Relative Path Traversal",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T16:54:50.760Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-ndfc-ptrce-BUSHLbp",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-ptrce-BUSHLbp"
}
],
"source": {
"advisory": "cisco-sa-ndfc-ptrce-BUSHLbp",
"defects": [
"CSCwk04223"
],
"discovery": "INTERNAL"
},
"title": "Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20449",
"datePublished": "2024-10-02T16:54:50.760Z",
"dateReserved": "2023-11-08T15:08:07.678Z",
"dateUpdated": "2024-10-02T19:33:43.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20352 (GCVE-0-2024-20352)
Vulnerability from cvelistv5 – Published: 2024-04-03 16:27 – Updated: 2024-08-01 21:59
VLAI
EPSS
VEX
Summary
A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affected system. An attacker could exploit this vulnerability by sending crafted requests to the web UI. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user, such as accessing password or log files or uploading and deleting existing files from the system.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-29 13:49 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Emergency Responder |
Affected:
10.5(1a)
Affected: 10.5(1) Affected: 11.5(4)SU2 Affected: 11.5(4)SU4 Affected: 11.5(4)SU3 Affected: 11.5(1) Affected: 11.5(3) Affected: 11.5(2) Affected: 11.5(4a) Affected: 11.5(4) Affected: 11.5(2a) Affected: 11.5(4)SU10 Affected: 11.5(4)SU9 Affected: 11.5(4)SU11 Affected: 12.5(1) Affected: 12.5(1)SU2 Affected: 12.5(1)SU3 Affected: 12.5(1)SU1 Affected: 12.5(1a) Affected: 12.5(1)SU4 Affected: 12.5(1)SU5 Affected: 12.5(1)SU6 Affected: 12.5(1)SU7 Affected: 12.5(1)SU8 Affected: 12.5(1)SU8a Affected: 12.5(1)SU8b Affected: 12.0(1) SU2 Affected: 12.0(1) SU1 Affected: 12.0(1) Affected: 10.0.2 Affected: 10.0(1) Affected: 11.0(1) Affected: 14SU1 Affected: 14SU2 Affected: 14 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-29T13:49:52.486063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-29T13:50:00.924Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:59:41.671Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-cem-csrf-suCmNjFr",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cem-csrf-suCmNjFr"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Emergency Responder",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "10.5(1a)"
},
{
"status": "affected",
"version": "10.5(1)"
},
{
"status": "affected",
"version": "11.5(4)SU2"
},
{
"status": "affected",
"version": "11.5(4)SU4"
},
{
"status": "affected",
"version": "11.5(4)SU3"
},
{
"status": "affected",
"version": "11.5(1)"
},
{
"status": "affected",
"version": "11.5(3)"
},
{
"status": "affected",
"version": "11.5(2)"
},
{
"status": "affected",
"version": "11.5(4a)"
},
{
"status": "affected",
"version": "11.5(4)"
},
{
"status": "affected",
"version": "11.5(2a)"
},
{
"status": "affected",
"version": "11.5(4)SU10"
},
{
"status": "affected",
"version": "11.5(4)SU9"
},
{
"status": "affected",
"version": "11.5(4)SU11"
},
{
"status": "affected",
"version": "12.5(1)"
},
{
"status": "affected",
"version": "12.5(1)SU2"
},
{
"status": "affected",
"version": "12.5(1)SU3"
},
{
"status": "affected",
"version": "12.5(1)SU1"
},
{
"status": "affected",
"version": "12.5(1a)"
},
{
"status": "affected",
"version": "12.5(1)SU4"
},
{
"status": "affected",
"version": "12.5(1)SU5"
},
{
"status": "affected",
"version": "12.5(1)SU6"
},
{
"status": "affected",
"version": "12.5(1)SU7"
},
{
"status": "affected",
"version": "12.5(1)SU8"
},
{
"status": "affected",
"version": "12.5(1)SU8a"
},
{
"status": "affected",
"version": "12.5(1)SU8b"
},
{
"status": "affected",
"version": "12.0(1) SU2"
},
{
"status": "affected",
"version": "12.0(1) SU1"
},
{
"status": "affected",
"version": "12.0(1)"
},
{
"status": "affected",
"version": "10.0.2"
},
{
"status": "affected",
"version": "10.0(1)"
},
{
"status": "affected",
"version": "11.0(1)"
},
{
"status": "affected",
"version": "14SU1"
},
{
"status": "affected",
"version": "14SU2"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affected system. An attacker could exploit this vulnerability by sending crafted requests to the web UI. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user, such as accessing password or log files or uploading and deleting existing files from the system."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "Relative Path Traversal",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-03T16:42:03.852Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-cem-csrf-suCmNjFr",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cem-csrf-suCmNjFr"
}
],
"source": {
"advisory": "cisco-sa-cem-csrf-suCmNjFr",
"defects": [
"CSCwf41263"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20352",
"datePublished": "2024-04-03T16:27:20.740Z",
"dateReserved": "2023-11-08T15:08:07.647Z",
"dateUpdated": "2024-08-01T21:59:41.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20310 (GCVE-0-2024-20310)
Vulnerability from cvelistv5 – Published: 2024-04-03 16:19 – Updated: 2024-08-01 21:59
VLAI
EPSS
VEX
Summary
A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an authenticated user of the interface.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-03 17:58 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
1 reference
Impacted products
41 products
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco IOS XE Software |
Affected:
N/A
|
|
| Cisco | Cisco Unified Communications Manager IM and Presence Service |
Affected:
10.5(1)
Affected: 10.5(2) Affected: 10.5(2a) Affected: 10.5(2b) Affected: 10.5(2)SU3 Affected: 10.5(2)SU2a Affected: 10.5(2)SU4a Affected: 10.5(2)SU4 Affected: 10.5(1)SU3 Affected: 10.5(1)SU1 Affected: 10.5(2)SU1 Affected: 10.5(2)SU2 Affected: 10.5(1)SU2 Affected: 11.5(1) Affected: 11.5(1)SU1 Affected: 11.5(1)SU2 Affected: 11.5(1)SU3 Affected: 11.5(1)SU3a Affected: 11.5(1)SU4 Affected: 11.5(1)SU5 Affected: 11.5(1)SU5a Affected: 11.5(1)SU6 Affected: 11.5(1)SU7 Affected: 11.5(1)SU8 Affected: 11.5(1)SU9 Affected: 11.5(1)SU10 Affected: 11.5(1)SU11 Affected: 11.0(1) Affected: 11.0(1)SU1 Affected: 12.5(1) Affected: 12.5(1)SU1 Affected: 12.5(1)SU2 Affected: 12.5(1)SU3 Affected: 12.5(1)SU4 Affected: 12.5(1)SU5 Affected: 12.5(1)SU6 Affected: 12.5(1)SU7 Affected: 14 Affected: 14SU1 Affected: 14SU2 Affected: 14SU2a Affected: 10.0(1) Affected: 10.0(1)SU1 Affected: 10.0(1)SU2 |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(1\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(1\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2a\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2a\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2b\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2b\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2\)su3
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2\)su3:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2\)su2a
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2\)su2a:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2\)su4a
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2\)su4a:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2\)su4
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2\)su4:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(1\)su1
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(1\)su1:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(1\)su2
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(1\)su2:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2\)su1
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2\)su1:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.5\(2\)su2
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\(2\)su2:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su11
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su11:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su2
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su2:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su3
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su3:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su3a
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su3a:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su4
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su4:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su5
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su5:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su5a
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su5a:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su6
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su6:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su7
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su7:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su8
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su8:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.5\(1\)su9
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\)su9:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.0\(1\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.0\(1\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
11.0\(1\)su1
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.0\(1\)su1:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)su1
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\)su1:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)su2
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\)su2:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)su3
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\)su3:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)su4
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\)su4:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)su5
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\)su5:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)su6
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\)su6:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
12.5\(1\)su7
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\)su7:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
14.0
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:14.0:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
14.0su1
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:14.0su1:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.0\(1\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.0\(1\):*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.0\(1\)su1
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.0\(1\)su1:*:*:*:*:*:*:* |
|
| cisco | unified_communications_manager_im_and_presence_service |
Affected:
10.0\(1\)su2
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.0\(1\)su2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(1\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(1\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2a\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2a\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2b\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2b\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su3"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su2a:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su2a"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su4a:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su4a"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su4"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su3"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(1\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(1\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(1\\)su2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(1\\)su2"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(1\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(1\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su2"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(1\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(1\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(2\\)su2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(2\\)su2"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.5\\(1\\)su2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.5\\(1\\)su2"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su11"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su2"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su3"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su3a:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su3a"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su4"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su5:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su5"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su5a:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su5a"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su6:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su6"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su7"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su8"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\\(1\\)su9:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.5\\(1\\)su9"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.0\\(1\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.0\\(1\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.0\\(1\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "11.0\\(1\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\)su2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)su2"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\)su3:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)su3"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\)su4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)su4"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\)su5:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)su5"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\)su6:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)su6"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\\(1\\)su7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "12.5\\(1\\)su7"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:14.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "14.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:14.0su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "14.0su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.0\\(1\\):*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.0\\(1\\)"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.0\\(1\\)su1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.0\\(1\\)su1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:10.0\\(1\\)su2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unified_communications_manager_im_and_presence_service",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "10.0\\(1\\)su2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20310",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-03T17:58:41.263017Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-02T16:23:39.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:59:41.851Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-cucm-imps-xss-quWkd9yF",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imps-xss-quWkd9yF"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco IOS XE Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "N/A"
}
]
},
{
"product": "Cisco Unified Communications Manager IM and Presence Service",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "10.5(1)"
},
{
"status": "affected",
"version": "10.5(2)"
},
{
"status": "affected",
"version": "10.5(2a)"
},
{
"status": "affected",
"version": "10.5(2b)"
},
{
"status": "affected",
"version": "10.5(2)SU3"
},
{
"status": "affected",
"version": "10.5(2)SU2a"
},
{
"status": "affected",
"version": "10.5(2)SU4a"
},
{
"status": "affected",
"version": "10.5(2)SU4"
},
{
"status": "affected",
"version": "10.5(1)SU3"
},
{
"status": "affected",
"version": "10.5(1)SU1"
},
{
"status": "affected",
"version": "10.5(2)SU1"
},
{
"status": "affected",
"version": "10.5(2)SU2"
},
{
"status": "affected",
"version": "10.5(1)SU2"
},
{
"status": "affected",
"version": "11.5(1)"
},
{
"status": "affected",
"version": "11.5(1)SU1"
},
{
"status": "affected",
"version": "11.5(1)SU2"
},
{
"status": "affected",
"version": "11.5(1)SU3"
},
{
"status": "affected",
"version": "11.5(1)SU3a"
},
{
"status": "affected",
"version": "11.5(1)SU4"
},
{
"status": "affected",
"version": "11.5(1)SU5"
},
{
"status": "affected",
"version": "11.5(1)SU5a"
},
{
"status": "affected",
"version": "11.5(1)SU6"
},
{
"status": "affected",
"version": "11.5(1)SU7"
},
{
"status": "affected",
"version": "11.5(1)SU8"
},
{
"status": "affected",
"version": "11.5(1)SU9"
},
{
"status": "affected",
"version": "11.5(1)SU10"
},
{
"status": "affected",
"version": "11.5(1)SU11"
},
{
"status": "affected",
"version": "11.0(1)"
},
{
"status": "affected",
"version": "11.0(1)SU1"
},
{
"status": "affected",
"version": "12.5(1)"
},
{
"status": "affected",
"version": "12.5(1)SU1"
},
{
"status": "affected",
"version": "12.5(1)SU2"
},
{
"status": "affected",
"version": "12.5(1)SU3"
},
{
"status": "affected",
"version": "12.5(1)SU4"
},
{
"status": "affected",
"version": "12.5(1)SU5"
},
{
"status": "affected",
"version": "12.5(1)SU6"
},
{
"status": "affected",
"version": "12.5(1)SU7"
},
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "14SU1"
},
{
"status": "affected",
"version": "14SU2"
},
{
"status": "affected",
"version": "14SU2a"
},
{
"status": "affected",
"version": "10.0(1)"
},
{
"status": "affected",
"version": "10.0(1)SU1"
},
{
"status": "affected",
"version": "10.0(1)SU2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based interface of Cisco Unified Communications Manager IM \u0026 Presence Service (Unified CM IM\u0026P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an authenticated user of the interface.\r\n\r This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "Relative Path Traversal",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-03T16:36:06.520Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-cucm-imps-xss-quWkd9yF",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imps-xss-quWkd9yF"
}
],
"source": {
"advisory": "cisco-sa-cucm-imps-xss-quWkd9yF",
"defects": [
"CSCwf41335"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20310",
"datePublished": "2024-04-03T16:19:40.031Z",
"dateReserved": "2023-11-08T15:08:07.631Z",
"dateUpdated": "2024-08-01T21:59:41.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13791 (GCVE-0-2024-13791)
Vulnerability from cvelistv5 – Published: 2025-02-14 11:10 – Updated: 2026-04-08 16:37
VLAI
EPSS
VEX
Title
Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function
Summary
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-14 16:42 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| bitpressadmin | Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist |
Affected:
0 , ≤ 1.5.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13791",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T16:42:33.130674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T16:42:43.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist",
"vendor": "bitpressadmin",
"versions": [
{
"lessThanOrEqual": "1.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "marco jacobs"
}
],
"descriptions": [
{
"lang": "en",
"value": "Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:37:33.408Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17fd14e7-503a-49e4-9344-5f8d51801eb3?source=cve"
},
{
"url": "https://github.com/WordPressBugBounty/plugins-bit-assist/blob/main/bit-assist/backend/app/HTTP/Controllers/DownloadController.php"
},
{
"url": "https://wordpress.org/plugins/bit-assist/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3239816/#file3"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-13T22:19:23.000Z",
"value": "Disclosed"
}
],
"title": "Bit Assist \u003c= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13791",
"datePublished": "2025-02-14T11:10:57.563Z",
"dateReserved": "2025-01-29T19:56:49.186Z",
"dateUpdated": "2026-04-08T16:37:33.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-13130 (GCVE-0-2024-13130)
Vulnerability from cvelistv5 – Published: 2025-01-05 01:00 – Updated: 2025-04-08 04:19
VLAI
EPSS
VEX
Title
Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal
Summary
A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by this issue is some unknown functionality of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
4.3 (Medium)
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-06 16:23 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.290204 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.290204 | signaturepermissions-required |
| https://vuldb.com/?submit.464260 | third-party-advisory |
| https://netsecfish.notion.site/Path-Traversal-Vul… | exploit |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dahua | IPC-HFW1200S |
Affected:
20241222
|
|
| Dahua | IPC-HFW2300R-Z |
Affected:
20241222
|
|
| Dahua | IPC-HFW5220E-Z |
Affected:
20241222
|
|
| Dahua | IPC-HDW1200S |
Affected:
20241222
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13130",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-06T16:23:59.572025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-06T16:24:05.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Interface"
],
"product": "IPC-HFW1200S",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
},
{
"modules": [
"Web Interface"
],
"product": "IPC-HFW2300R-Z",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
},
{
"modules": [
"Web Interface"
],
"product": "IPC-HFW5220E-Z",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
},
{
"modules": [
"Web Interface"
],
"product": "IPC-HDW1200S",
"vendor": "Dahua",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "netsecfish (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by this issue is some unknown functionality of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: \u0027../filedir\u0027. The attack may be launched remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S bis 20241222 ausgemacht. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei ../mtd/Config/Sha1Account1 der Komponente Web Interface. Mit der Manipulation mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T04:19:53.063Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-290204 | Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.290204"
},
{
"name": "VDB-290204 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.290204"
},
{
"name": "Submit #464260 | IntelBras IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z, IPC-HDW1200S, VIP S3020 G2, VIP S4020 G2, VIP S4320 G2, VIP S4020 G3 WebVersion: 3.2.1.225946; WebVersion: 3.2.1.291804 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.464260"
},
{
"tags": [
"exploit"
],
"url": "https://netsecfish.notion.site/Path-Traversal-Vulnerability-in-IntelBras-IP-Cameras-mtd-Config-Sha1Account1-and-mtd-Confi-15e6b683e67c80809442ee3425f753b7?pvs=4"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-01-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-01-10T14:21:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-13130",
"datePublished": "2025-01-05T01:00:12.751Z",
"dateReserved": "2025-01-04T09:11:19.926Z",
"dateUpdated": "2025-04-08T04:19:53.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12897 (GCVE-0-2024-12897)
Vulnerability from cvelistv5 – Published: 2024-12-22 23:31 – Updated: 2024-12-27 08:51 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Intelbras VIP S4320 G2 Web Interface Sha1Account1 path traversal
Summary
A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affects an unknown part of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
4.3 (Medium)
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-24 16:00 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.289167 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.289167 | signaturepermissions-required |
| https://vuldb.com/?submit.464260 | third-party-advisory |
| https://netsecfish.notion.site/Path-Traversal-Vul… | exploit |
| https://netsecfish.notion.site/Path-Traversal-Vul… | exploit |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Intelbras | VIP S3020 G2 |
Affected:
20241222
|
|
| Intelbras | VIP S4020 G2 |
Affected:
20241222
|
|
| Intelbras | VIP S4020 G3 |
Affected:
20241222
|
|
| Intelbras | VIP S4320 G2 |
Affected:
20241222
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12897",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T16:00:18.160289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T16:00:32.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://netsecfish.notion.site/Path-Traversal-Vulnerability-in-IntelBras-IP-Cameras-mtd-Config-Sha1Account1-and-mtd-Confi-15e6b683e67c80809442ee3425f753b7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Web Interface"
],
"product": "VIP S3020 G2",
"vendor": "Intelbras",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
},
{
"modules": [
"Web Interface"
],
"product": "VIP S4020 G2",
"vendor": "Intelbras",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
},
{
"modules": [
"Web Interface"
],
"product": "VIP S4020 G3",
"vendor": "Intelbras",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
},
{
"modules": [
"Web Interface"
],
"product": "VIP S4320 G2",
"vendor": "Intelbras",
"versions": [
{
"status": "affected",
"version": "20241222"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "netsecfish (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affects an unknown part of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: \u0027../filedir\u0027. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 bis 20241222 ausgemacht. Sie wurde als kritisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei ../mtd/Config/Sha1Account1 der Komponente Web Interface. Durch Beeinflussen mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-27T08:51:42.245Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-289167 | Intelbras VIP S4320 G2 Web Interface Sha1Account1 path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.289167"
},
{
"name": "VDB-289167 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.289167"
},
{
"name": "Submit #464260 | IntelBras IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z, IPC-HDW1200S, VIP S3020 G2, VIP S4020 G2, VIP S4320 G2, VIP S4020 G3 WebVersion: 3.2.1.225946; WebVersion: 3.2.1.291804 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.464260"
},
{
"tags": [
"exploit"
],
"url": "https://netsecfish.notion.site/Path-Traversal-Vulnerability-in-IntelBras-IP-Cameras-mtd-Config-Sha1Account1-and-mtd-Confi-15e6b683e67c80809442ee3425f753b7?pvs=4"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2024-12-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-12-22T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-12-27T09:56:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "Intelbras VIP S4320 G2 Web Interface Sha1Account1 path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-12897",
"datePublished": "2024-12-22T23:31:05.102Z",
"dateReserved": "2024-12-22T08:47:43.200Z",
"dateUpdated": "2024-12-27T08:51:42.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12645 (GCVE-0-2024-12645)
Vulnerability from cvelistv5 – Published: 2024-12-16 06:49 – Updated: 2024-12-16 16:42
VLAI
EPSS
VEX
Title
Chunghwa Telecom topm-client - Arbitrary File Read
Summary
The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to read arbitrary files on the user's system.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-16 16:42 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-8297-13670-1.html | third-party-advisory |
| https://www.twcert.org.tw/en/cp-139-8303-3220b-2.html | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Chunghwa Telecom | topm-client |
Affected:
0.3.14 , ≤ 0.3.17
(custom)
|
Date Public
2024-12-16 06:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-16T16:42:04.647929Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-16T16:42:18.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "topm-client",
"vendor": "Chunghwa Telecom",
"versions": [
{
"lessThanOrEqual": "0.3.17",
"status": "affected",
"version": "0.3.14",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-12-16T06:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u0026nbsp; The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to read arbitrary files on the user\u0027s system."
}
],
"value": "The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to read arbitrary files on the user\u0027s system."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
},
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139: Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-16T06:49:30.828Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8297-13670-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8303-3220b-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version 0.3.18 or later."
}
],
"value": "Update to version 0.3.18 or later."
}
],
"source": {
"advisory": "TVN-202412005",
"discovery": "EXTERNAL"
},
"title": "Chunghwa Telecom topm-client - Arbitrary File Read",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-12645",
"datePublished": "2024-12-16T06:49:30.828Z",
"dateReserved": "2024-12-16T01:39:26.813Z",
"dateUpdated": "2024-12-16T16:42:18.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation MIT-5.1
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-20.1
Implementation
Strategy: Input Validation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
- Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes:
- realpath() in C
- getCanonicalPath() in Java
- GetFullPath() in ASP.NET
- realpath() or abs_path() in Perl
- realpath() in PHP
Mitigation MIT-29
Operation
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-139: Relative Path Traversal
An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.