PT-2014-4914 · Wd · Wd Arkeia Virtual Appliance

Publicado 2014-04-28 · Atualizado 2020-02-24 · CVE-2014-2846

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WD Arkeia virtual appliance (AVA) versions prior to 10.2.9

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files and execute arbitrary PHP code. This is achieved by manipulating the lang Cookie parameter with a /././ (dot dot dot slash dot slash) sequence, as demonstrated by a request to "login/doLogin" API endpoint.

Recommendations For versions prior to 10.2.9, update to version 10.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the login/doLogin API endpoint to minimize the risk of exploitation. Avoid using the lang Cookie parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-2846

Produtos afetados

Wd Arkeia Virtual Appliance

Referências · 5

• 🔥 http://seclists.org/fulldisclosure/2014/Apr/257 · Exploit
• 🔥 https://exploit-db.com/exploits/33005 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2846 · Nota de Segurança
• http://securityfocus.com/archive/1/531910/100/0/threaded · Nota
• http://wiki.arkeia.com/index.php/Path_Traversal_Remote_Code_Execution · Nota