PT-2021-21321 · Synerion · Synerion Timenet

Published 2021-09-07 · Updated 2021-12-16 · CVE-2021-36717

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Synerion TimeNet version 9.21

Description The issue allows an attacker to perform a directory traversal attack using a web browser and some knowledge of default files and directories on the system. On the Name parameter, the attacker can return to the root directory and open the host file, potentially giving them the ability to view restricted files. This could provide the attacker with more information required to further compromise the system.

Recommendations For Synerion TimeNet version 9.21, consider restricting access to the Name parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the Name parameter in a way that could allow directory traversal until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-36717

Affected Products

Synerion Timenet

References · 5

• https://osv.dev/vulnerability/CVE-2021-36717 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36717 · Security Note
• https://gov.il/en/departments/faq/cve_advisories · Note
• https://t.me/cvenotify/20963 · Telegram Post
• https://t.me/cibsecurity/28340 · Telegram Post