PT-2023-12958

CVE-2022-2893

·

Published

2023-01-17

·

Updated

2023-01-23

Description by

CVSS 3.1
8.2
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Name of the Vulnerable Software and Affected Versions RONDS EPM version 1.19.5
Description The issue is related to the improper validation of the filename parameter, which could allow an unauthorized user to specify file paths and download files.
Recommendations For RONDS EPM version 1.19.5, consider restricting access to the filename parameter to prevent unauthorized file downloads until a patch is available.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2022-2893
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com