PT-2017-13298 · Squiz · Squiz Matrix+1

Published 2017-11-30 · Updated 2017-12-14 · CVE-2017-14196

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squiz Matrix versions 5.3 through 5.3.6.1 Squiz Matrix version 5.4.1.3

Description An issue in the 'File Bridge' plugin causes an information disclosure due to a Path Traversal issue, allowing the existence of files outside of the bridged path to be confirmed.

Recommendations For Squiz Matrix versions 5.3 through 5.3.6.1, consider disabling the 'File Bridge' plugin until a patch is available. For Squiz Matrix version 5.4.1.3, consider disabling the 'File Bridge' plugin until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-14196

Affected Products

File Bridge

Squiz Matrix

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-14196 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14196 · Vendor Advisory
• http://devalias.net/devalias/2017/09/07/squiz-matrix-multiple-vulnerabilities · Note