PT-2022-11427 · Leostream · Leostream Connection Broker

Published 2022-01-18 · Updated 2022-07-12 · CVE-2021-41551

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Leostream Connection Broker version 9.0.40.17

Description The issue allows administrators to conduct directory traversal attacks by uploading a ZIP file that contains a symbolic link. This can potentially lead to unauthorized access to sensitive files or directories.

Recommendations For Leostream Connection Broker version 9.0.40.17, consider restricting the upload of ZIP files or implementing validation checks to prevent the inclusion of symbolic links as a temporary workaround until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2021-41551

Affected Products

Leostream Connection Broker

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-41551 · Security Note
• https://leostream.com/wp-content/uploads/2018/11/Leostream_release_notes.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41551 · Vendor Advisory
• https://leostream.com/resource/leostream-connection-broker-9-0 · Vendor Advisory
• https://t.me/cvenotify/25591 · Telegram Post
• https://t.me/cvenotify/25916 · Telegram Post
• https://t.me/cibsecurity/35709 · Telegram Post