PT-2022-8017 · Unknown · Aerouk Imageserve

Published 2022-12-30 · Updated 2024-05-17 · CVE-2017-20152

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions aerouk imageserve (affected versions not specified)

Description A problematic vulnerability was found in aerouk imageserve, affecting an unknown function of the file public/viewer.php of the component File Handler. The manipulation of the filelocation argument leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high, and the exploitability is difficult. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, it is recommended to apply a patch. The name of the patch is bd23c784f0e5cb12f66d15c100248449f87d72e2. As a temporary workaround, consider restricting access to the public/viewer.php file until the patch is applied. Additionally, avoid using the filelocation argument in the affected component until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-20152

Affected Products

Aerouk Imageserve

References · 8

• 🔥 https://github.com/aerouk/imageserve/pull/27 · Exploit
• https://github.com/aerouk/imageserve/commit/bd23c784f0e5cb12f66d15c100248449f87d72e2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-20152 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20152 · Vendor Advisory
• https://vuldb.com/?id.217056 · Note
• https://t.me/cibsecurity/55557 · Telegram Post
• https://vuldb.com/?ctiid.217056 · Note
• https://t.me/cvenotify/41012 · Telegram Post