PT-2022-25028 · Unknown · Systematic Fix Adapter

Ivashchenko Sergey · Published 2022-09-05 · Updated 2022-09-09 · CVE-2022-39838

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Systematic FIX Adapter (ALFAFX) version 2.4.0.25

Description The issue allows remote file inclusion via a UNC share pathname and also enables absolute path traversal to local pathnames.

Recommendations For version 2.4.0.25, consider restricting access to UNC share pathnames and limiting absolute path traversal to prevent unauthorized file inclusion and access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-39838

Affected Products

Systematic Fix Adapter

References · 6

• 🔥 https://github.com/jet-pentest/CVE-2022-39838 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39838 · Security Note
• http://systematicalpha.com/trading-programs/systematic-alpha-fx-master-fund · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39838 · Vendor Advisory
• https://t.me/cvenotify/35737 · Telegram Post
• http://systematicalpha.com/company · Note