PT-2015-3063 · Ge Digital · Ge Digital Energy Mds Pulsenet Enterprise+1
Andrea Micalizzi
·
Publicado
2015-09-16
·
Atualizado
2015-09-23
·
CVE-2015-6459
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise versions prior to 3.1.5
Description
The issue is related to an absolute path traversal vulnerability in the download feature of the FileDownloadServlet. This vulnerability allows remote attackers to read or delete arbitrary files via a full pathname. The vulnerability exists due to incorrect restriction of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to read or delete arbitrary files using the full directory path.
Recommendations
For versions prior to 3.1.5, update to version 3.1.5 or later to resolve the issue.
As a temporary workaround, consider restricting access to the FileDownloadServlet to minimize the risk of exploitation.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ge Digital Energy Mds Pulsenet
Ge Digital Energy Mds Pulsenet Enterprise