PT-2019-12039 · Iobroker · Iobroker.Controller

Publicado 2019-11-21 · Atualizado 2019-12-03 · CVE-2019-10767

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iobroker.controller versions prior to 2.0.25

Description The issue allows an attacker to include file contents from outside the intended directory using the administrative web panel. This can be exploited by making a request for an adapter file. The attacker must be logged in if authentication is enabled, although authentication is disabled by default.

Recommendations Upgrade to version 2.0.25 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-10767

GHSA-CMCH-296J-WFVW

SNYK-JS-IOBROKERJSCONTROLLER-534881

Produtos afetados

Iobroker.Controller

Referências · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881 · Exploit
• https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fda · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-10767 · Nota de Segurança
• https://npmjs.com/advisories/1419 · Nota
• https://osv.dev/vulnerability/GHSA-cmch-296j-wfvw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10767 · Aviso do Fabricante