PT-2022-7975 · Unknown · Album Lock

Published 2022-06-27 · Updated 2022-07-07 · CVE-2017-20102

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Album Lock version 4.0

Description A critical issue was found in Album Lock, affecting some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. This issue requires local attacking to be exploited. The exploit has been disclosed to the public and may be used.

Recommendations For Album Lock version 4.0, as a temporary workaround, consider restricting access to the /getImage file until a patch is available. Avoid using the filePaht argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-20102

Affected Products

Album Lock

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-20102 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20102 · Vendor Advisory
• https://vuldb.com/?id.97268 · Note
• https://vulnerability-lab.com/get_content.php?id=2033 · Note
• https://t.me/cibsecurity/45191 · Telegram Post
• https://t.me/cvenotify/32716 · Telegram Post