CVE-2017-17739

Name of the Vulnerable Software and Affected Versions BrightSign Digital Signage (4k242) versions 6.2.63 and below

Description The issue allows directory traversal via the "/storage.html" API endpoint, specifically through the rp parameter. This enables an attacker to read or write to files.

Recommendations For versions 6.2.63 and below, consider restricting access to the "/storage.html" API endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the rp parameter in the affected API endpoint until the issue is resolved.