PT-2019-11510 · Linagora · Linagora Hublin

Published 2019-07-23 · Updated 2019-07-26 · CVE-2019-1010205

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff)

Description: The issue allows an attacker to access any file with a fixed extension on the server. This is due to a Directory Traversal flaw in the web-view renderer component. The attack vector involves sending a specially crafted HTTP request.

Recommendations: For LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff), consider restricting access to the web-view renderer component until a fix is available. As a temporary workaround, restrict the handling of specially crafted HTTP requests to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-1010205

Affected Products

Linagora Hublin

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-1010205 · Security Note
• https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1 · Vendor Advisory