PT-2020-13073 · Gigamon · Gigavue

Balazs Hambalko · Published 2020-04-29 · Updated 2020-05-18 · CVE-2020-12251

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gigamon GigaVUE version 5.5.01.11

Description An issue was discovered in the upload functionality, allowing an authenticated user to change the filename value in the POST method to achieve directory traversal via a ../ sequence. This could potentially allow an attacker to obtain a complete directory listing of the machine.

Recommendations For Gigamon GigaVUE version 5.5.01.11, consider restricting access to the upload functionality until a patch is available. As a temporary workaround, avoid using the filename value in the POST method to prevent directory traversal attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-12251

Affected Products

Gigavue

References · 6

• https://osv.dev/vulnerability/CVE-2020-12251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12251 · Security Note
• https://t.me/cvenotify/3404 · Telegram Post
• https://seclists.org/fulldisclosure/2020/Apr/56 · Note
• http://packetstormsecurity.com/files/157484/Gigamon-GigaVUE-5.5.01.11-Directory-Traversal-File-Upload.html · Note
• https://t.me/cybersecuritytechnologies/1046 · Telegram Post