PT-2015-3636 · Gdl · Ganesha Digital Library

Publicado 2015-01-13 · Atualizado 2017-09-08 · CVE-2014-100029

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ganesha Digital Library (GDL) version 4.2

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. (dot dot) in specific parameters. The vulnerable parameters are newlang and newtheme.

Recommendations For Ganesha Digital Library (GDL) version 4.2, consider restricting access to the class/session.php file until a patch is available. As a temporary workaround, avoid using the newlang and newtheme parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-100029

Produtos afetados

Ganesha Digital Library

Referências · 4

• 🔥 https://exploit-db.com/exploits/31961 · Exploit
• 🔥 http://packetstormsecurity.com/files/125464 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-100029 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91555 · Nota