PT-2019-13010 · Pydio · Pydio Cells

Publicado 2019-06-19 · Atualizado 2020-08-24 · CVE-2019-12901

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pydio Cells versions prior to 1.5.0

Description The issue allows an attacker with minimum privilege to upload files to and delete files or folders from an unprivileged directory. This can lead to privilege escalation due to the failure to neutralize '../' elements.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-12901

Produtos afetados

Pydio Cells

Referências · 4

• https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12901 · Aviso do Fabricante
• https://research.loginsoft.com/vulnerability/multiple-vulnerabilities-in-pydio-cells-1-4-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12901 · Nota de Segurança