PT-2021-15413
CVE-2021-23241
·
تاريخ النشر
2021-01-07
·
تاريخ التحديث
2021-01-12
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
MERCUSYS Mercury X18G version 1.0.5
Description
The issue allows Directory Traversal via ../ in conjunction with a
loginLess or login.htm URI to the web server, enabling authentication bypass. This is demonstrated by the /loginLess/../../etc/passwd URI, which showcases the vulnerability.Recommendations
For MERCUSYS Mercury X18G version 1.0.5, consider restricting access to the
loginLess and login.htm URIs as a temporary workaround until a patch is available. Additionally, avoid using the ../ sequence in conjunction with these URIs to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾