PT-2019-1634 · Openwsman+3 · Openwsman+3
Publicado
2019-03-12
·
Atualizado
2023-02-12
·
CVE-2019-3816
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Openwsman versions up to and including 2.6.9
Description
The issue allows a remote, unauthenticated attacker to disclose arbitrary files by sending a specially crafted HTTP request to the openwsman server. This is due to the working directory of the openwsmand daemon being set to the root directory. The vulnerability can be exploited to reveal protected information.
Recommendations
For Openwsman versions up to and including 2.6.9, consider updating to a version later than 2.6.9 to resolve the issue. As a temporary workaround, restrict access to the openwsman server to minimize the risk of exploitation.
Correção
Path traversal
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Openwsman
Red Hat
Suse