PT-2019-12037 · Iobroker · Iobroker.Admin

Fabio Carretto · Publicado 2019-11-20 · Atualizado 2020-09-04 · CVE-2019-10765

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iobroker.admin versions prior to 3.6.12

Description The issue allows an attacker to include file contents from outside the intended directory due to a path traversal problem. The package fails to restrict access to folders outside of the intended folder in the /log/ route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack, but the package has authentication disabled by default.

Recommendations Upgrade to version 3.6.12 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-10765

GHSA-54XJ-Q58H-9X57

SNYK-JS-IOBROKERADMIN-534634

Produtos afetados

Iobroker.Admin

Referências · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634 · Exploit
• https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd · Correção
• https://osv.dev/vulnerability/GHSA-54xj-q58h-9x57 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10765 · Aviso do Fabricante
• https://npmjs.com/advisories/1346 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10765 · Nota de Segurança