CVE-2023-2909 - A Directory traversal vulnerability was found on EZ Sync service of ADM

Back Back to CVE browser

CRITICAL

A Directory traversal vulnerability was found on EZ Sync service of ADM

Published May 31, 2023

10.0

CRITICAL

CVSS 3.1

EPSS 0.67%

Description

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

Affected products

Vendor Asustor Product ADM Default
affected
- Version
  4.0
  Status
  affected
  Constraints
  <=4.0.6.REG2
- Version
  4.1
  Status
  affected
  Constraints
  <=4.1.0.RLQ1
- Version
  4.2
  Status
  affected
  Constraints
  <=4.2.1.RGE2