PT-2015-3636 · Gdl · Ganesha Digital Library

Published 2015-01-13 · Updated 2017-09-08 · CVE-2014-100029

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ganesha Digital Library (GDL) version 4.2

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. (dot dot) in specific parameters. The vulnerable parameters are newlang and newtheme.

Recommendations For Ganesha Digital Library (GDL) version 4.2, consider restricting access to the class/session.php file until a patch is available. As a temporary workaround, avoid using the newlang and newtheme parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-100029

Affected Products

Ganesha Digital Library

References · 4

• 🔥 https://exploit-db.com/exploits/31961 · Exploit
• 🔥 http://packetstormsecurity.com/files/125464 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-100029 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91555 · Note