PT-2017-6488 · Cybele · Thinfinity Remote Desktop Workstation

Publicado 2017-10-06 · Atualizado 2020-08-19 · CVE-2015-1429

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cybele Software Thinfinity Remote Desktop Workstation version 3.0.0.3

Description A directory traversal issue allows remote attackers to download arbitrary files by utilizing a .. (dot dot) in an unspecified parameter. This could potentially lead to unauthorized access to sensitive information.

Recommendations For Cybele Software Thinfinity Remote Desktop Workstation version 3.0.0.3, consider restricting access to sensitive files and directories as a temporary workaround until a patch is available. Avoid using the vulnerable parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-1429

Produtos afetados

Thinfinity Remote Desktop Workstation

Referências · 3

• http://cybelesoft.com/blog/index.php/cybele-software-inc-security-bulletin-2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-1429 · Nota de Segurança
• https://perspectiverisk.com/security-advisory-thinfinity-remote-desktop-workstation-directory-traversal · Nota