CVE-2021-29395

Name of the Vulnerable Software and Affected Versions NorthStar Club Management version 6.3

Description The issue allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application due to directory traversal in the /northstar/filemanager/download.jsp endpoint.

Recommendations For NorthStar Club Management version 6.3, consider restricting access to the /northstar/filemanager/download.jsp endpoint until a patch is available. As a temporary workaround, limit the ability to download files to only necessary personnel to minimize the risk of exploitation.