PT-2017-6294 · Sap · Hybris Commerce

Published 2017-08-28 · Updated 2019-08-27 · CVE-2014-8871

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions hybris Commerce software suite versions 5.0.3.3 and earlier hybris Commerce software suite versions 5.0.0.3 and earlier hybris Commerce software suite versions 5.0.4.4 and earlier hybris Commerce software suite versions 5.1.0.1 and earlier hybris Commerce software suite versions 5.1.1.2 and earlier hybris Commerce software suite versions 5.2.0.3 and earlier hybris Commerce software suite versions 5.3.0.1 and earlier

Description The issue is related to a directory traversal vulnerability.

Recommendations For hybris Commerce software suite versions 5.0.3.3 and earlier, update to a version later than 5.0.3.3. For hybris Commerce software suite versions 5.0.0.3 and earlier, update to a version later than 5.0.0.3. For hybris Commerce software suite versions 5.0.4.4 and earlier, update to a version later than 5.0.4.4. For hybris Commerce software suite versions 5.1.0.1 and earlier, update to a version later than 5.1.0.1. For hybris Commerce software suite versions 5.1.1.2 and earlier, update to a version later than 5.1.1.2. For hybris Commerce software suite versions 5.2.0.3 and earlier, update to a version later than 5.2.0.3. For hybris Commerce software suite versions 5.3.0.1 and earlier, update to a version later than 5.3.0.1.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-8871

Affected Products

Hybris Commerce

References · 5

• 🔥 http://seclists.org/fulldisclosure/2015/Feb/63 · Exploit
• 🔥 http://packetstormsecurity.com/files/130444/Hybris-Commerce-Software-Suite-5.x-File-Disclosure-Traversal.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8871 · Security Note
• http://securityfocus.com/bid/72681 · Note
• http://securityfocus.com/archive/1/534722/100/1600/threaded · Note