CVE-2020-35362 - DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp

Back Back to CVE browser

HIGH

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp

Published Dec 26, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.64%

Description

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter (the attacker must provide the correct fileOrgName value).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23038
Advisory
https://github.com/kbgsft/vuln-dext5upload/wiki/File-Download-Vulnerability-in-DEXT5Upload-2.7.1262310-by-xcuter
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23038		Advisory
https://github.com/kbgsft/vuln-dext5upload/wiki/File-Download-Vulnerability-in-DEXT5Upload-2.7.1262310-by-xcuter		x_refsource_MISCExploitThird Party Advisory