PT-2013-5366
CVE-2013-5107
·
تاريخ النشر
2013-12-14
·
تاريخ التحديث
2013-12-16
الوصف من
CVSS 2.0
5.0
متوسطةالمقاييسAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
RockMongo versions 1.1.5 and earlier
Description
The issue allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability. This can be achieved by including a .. (dot dot) in the
ROCK LANG cookie, as seen in a login.index action to "index.php".Recommendations
For RockMongo versions 1.1.5 and earlier, consider restricting access to the
ROCK LANG cookie to minimize the risk of exploitation until a patch is available. Avoid using the ROCK LANG cookie with untrusted input in the "index.php" endpoint. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾