PT-2018-16136

CVE-2018-3712

Publicado

2018-06-07

Atualizado

2019-10-09

Descrição por

CVSS 3.1

6.5

Média

MétricasAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions serve versions prior to 6.4.9

Description The issue arises from the software's failure to properly handle %2e (.) and %2f (/) characters in paths, allowing a malicious user to traverse the directory tree and list the contents of any directory the user running the process has access to. This vulnerability only allows listing of directory contents and does not allow reading of arbitrary files.

Recommendations Update to version 6.4.9 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Identificadores relacionados

CVE-2018-3712