CVE-2019-13941

Name of the Vulnerable Software and Affected Versions: OZW672 versions prior to V10.00 OZW772 versions prior to V10.00

Description: A security issue has been identified where vulnerable versions of OZW Web Server use predictable path names for project files created by authenticated users through the export function. This allows a remote attacker to download project files without authentication by accessing a specific uniform resource locator on the web server. The issue can be exploited by an unauthenticated attacker with network access, without requiring any user interaction. Successful exploitation compromises the confidentiality of the targeted system.

Recommendations: For OZW672 versions prior to V10.00, update to version V10.00 or later to resolve the issue. For OZW772 versions prior to V10.00, update to version V10.00 or later to resolve the issue.