PT-2015-4981

CVE-2015-0933

·

Published

2015-03-04

·

Updated

2015-03-04

Description by

CVSS 2.0
3.5
Low
MetricsAV:N/AC:M/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions ShareLaTeX versions 0.1.3 and earlier
Description The issue allows remote authenticated users to read arbitrary files via a include command due to an absolute path traversal vulnerability when the paranoid openin any setting is omitted.
Recommendations For ShareLaTeX versions 0.1.3 and earlier, consider adding the paranoid openin any setting to prevent absolute path traversal. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2015-0933
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com