PT-2019-10237 · Tecrail · Tecrail Responsive Filemanager

Farisv · Published 2019-02-25 · Updated 2019-02-25 · CVE-2018-20795

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: tecrail Responsive FileManager version 9.13.4

Description: The issue allows remote attackers to read arbitrary files via path traversal using the path parameter, through the copy cut action in "ajax calls.php" and the paste clipboard action in "execute.php".

Recommendations: For version 9.13.4, consider restricting access to the ajax calls.php and execute.php files to minimize the risk of exploitation, and avoid using the path parameter in these actions until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-20795

Affected Products

Tecrail Responsive Filemanager

References · 3

• 🔥 https://exploit-db.com/exploits/45987 · Exploit
• https://osv.dev/vulnerability/CVE-2018-20795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20795 · Security Note