PT-2019-17063
CVE-2019-4400
·
تاريخ النشر
2019-10-25
·
تاريخ التحديث
2019-10-28
الوصف من
CVSS 3.1
4.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
IBM Cloud Orchestrator versions 2.4 through 2.4.0.5
IBM Cloud Orchestrator versions 2.5 through 2.5.0.9
Description
The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing
dot dot sequences (/../) to view arbitrary files on the system.Recommendations
For IBM Cloud Orchestrator versions 2.4 through 2.4.0.5, update to a version outside of this range to resolve the issue.
For IBM Cloud Orchestrator versions 2.5 through 2.5.0.9, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾