PT-2019-12037 · Iobroker · Iobroker.Admin

Fabio Carretto · Published 2019-11-20 · Updated 2020-09-04 · CVE-2019-10765

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iobroker.admin versions prior to 3.6.12

Description The issue allows an attacker to include file contents from outside the intended directory due to a path traversal problem. The package fails to restrict access to folders outside of the intended folder in the /log/ route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack, but the package has authentication disabled by default.

Recommendations Upgrade to version 3.6.12 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-10765

GHSA-54XJ-Q58H-9X57

SNYK-JS-IOBROKERADMIN-534634

Affected Products

Iobroker.Admin

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634 · Exploit
• https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd · Patch
• https://osv.dev/vulnerability/GHSA-54xj-q58h-9x57 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10765 · Security Note
• https://npmjs.com/advisories/1346 · Note