PT-2014-4787 · Devexpress · Devexpress Aspxfilemanager Control

Published 2014-06-06 · Updated 2018-10-09 · CVE-2014-2575

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC versions prior to 13.1.10 DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC versions 13.2.x prior to 13.2.9

Description The issue allows remote authenticated users to read or write arbitrary files. This is achieved by exploiting a directory traversal vulnerability in the File Manager component via a .. (dot dot) in the EVENTARGUMENT parameter.

Recommendations For versions prior to 13.1.10, update to version 13.1.10 or later. For versions 13.2.x prior to 13.2.9, update to version 13.2.9 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-2575

Affected Products

Devexpress Aspxfilemanager Control

References · 10

• 🔥 http://exploit-db.com/exploits/33700 · Exploit
• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2014-006/-directory-traversal-in-devexpress-asp-net-file-manager · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Jun/24 · Exploit
• 🔥 https://exploit-db.com/exploits/33700 · Exploit
• http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2575 · Security Note
• http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2.8-Directory-Traversal.html · Note
• http://securityfocus.com/bid/67902 · Note
• http://securityfocus.com/archive/1/532304/100/0/threaded · Note
• http://osvdb.org/show/osvdb/107742 · Note