PT-2020-20585 · Aquaforest · Aquaforest Tiff Server

Published 2020-03-18 · Updated 2021-07-21 · CVE-2020-9325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aquaforest TIFF Server version 4.0

Description The issue allows for unauthenticated arbitrary file download. This means that an attacker can download files from the server without needing to authenticate.

Recommendations For Aquaforest TIFF Server version 4.0, update to a newer version that contains a fix for this issue. If no specific fix is provided for version 4.0, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Path traversal

Weakness Enumeration

CWE-306

CWE-22

Related Identifiers

CVE-2020-9325

Affected Products

Aquaforest Tiff Server

References · 6

• 🔥 https://criticalstart.com/multiple-vulnerabilities-discovered-in-tiff-server-from-aquaforest · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9325 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9325 · Vendor Advisory
• https://aquaforest.com/en/release_history.asp · Vendor Advisory
• https://criticalstart.com/resources · Note
• https://t.me/cvenotify/1853 · Telegram Post