Mohamed Amine Ouad

The issue allows relative path traversal via a specific parameter in the https request after authentication, which enables access to files on the system that are not intended to be accessible via the web application.

The issue allows users belonging to the same AMOS authorization group to retrieve data from certain log files, potentially leading to privilege escalation. All AMOS users are considered highly privileged in the ENM system and must be previously defined and authorized by the Security Administrator. These users can access log files under a common path and read stored information to conduct privilege escalation.

The issue concerns incorrect access-control behavior, affecting users with highly privileged roles. It allows users within the same AMOS authorization group to retrieve managed-network data not intended for their access, specifically data restricted to a subset of the group.

The issue affects customer documentation browsing libraries under ALEX in OSS-RC systems, making them subject to Cross-Site Scripting. This problem is resolved in the new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager. The vulnerability only affects products that are no longer supported by the maintainer.

The issue affects OSS-RC systems during data migration procedures, where files containing `usernames` and `passwords` are left undeleted in folders accessible by top privileged accounts only. This issue only affects products that are no longer supported by the maintainer. It is recommended that OSS-RC customers upgrade to Ericsson Network Manager, a new generation OSS system.