CVE-2013-4861

Name of the Vulnerable Software and Affected Versions: MiCasaVerde VeraLite version 1.5.408

Description: The issue allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter in the cgi-bin/cmh/get file.sh script.

Recommendations: For version 1.5.408, consider restricting access to the cgi-bin/cmh/get file.sh script until a patch is available. As a temporary workaround, avoid using the filename parameter with .. (dot dot) sequences in the affected script. At the moment, there is no information about a newer version that contains a fix for this vulnerability.