PT-2020-14204 · Intranda · Goobi Viewer Core

Janvonde · Published 2020-07-22 · Updated 2020-07-24 · CVE-2020-15124

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Goobi Viewer Core versions prior to 4.8.3

Description A path traversal issue allows remote attackers to access files on the server via the application, potentially leading to the disclosure of sensitive information. This is limited to files accessible to the application server user.

Recommendations For versions prior to 4.8.3, update to version 4.8.3 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-15124

GHSA-7GWQ-XQW3-CR63

Affected Products

Goobi Viewer Core

References · 4

• https://github.com/intranda/goobi-viewer-core/commit/44ceb8e2e7e888391e8a941127171d6366770df3 · Patch
• https://osv.dev/vulnerability/CVE-2020-15124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15124 · Security Note
• https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7gwq-xqw3-cr63 · Note