PT-2019-11665
CVE-2019-10257
·
تاريخ النشر
2019-06-19
·
تاريخ التحديث
2019-06-20
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions:
Zucchetti HR Portal versions prior to 2019-03-15
Description:
The issue allows unauthenticated users to perform Directory Traversal, escaping the restricted location using dot-dot-slash notation to access files or directories elsewhere on the system. This enables access to the application's Java sources from /WEB-INF/classes/*.class.
Recommendations:
For versions prior to 2019-03-15, consider restricting access to the /WEB-INF/classes/ directory to prevent unauthorized access to Java sources until a fix is available. As a temporary workaround, limit the ability of unauthenticated users to traverse directories using dot-dot-slash notation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾