PT-2022-9924 · Unknown · Northstar Club Management

Alexandre Larocque · Published 2022-02-04 · Updated 2022-02-08 · CVE-2021-29398

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NorthStar Club Management version 6.3

Description The issue allows remote unauthenticated users to browse and list directories across the entire filesystem of the host of the web application through a directory traversal vulnerability in the /northstar/Common/NorthFileManager/fileManagerObjects.jsp endpoint.

Recommendations For NorthStar Club Management version 6.3, update to a version that fixes the directory traversal issue in the /northstar/Common/NorthFileManager/fileManagerObjects.jsp endpoint to prevent unauthorized access to the filesystem. As a temporary workaround, consider restricting access to the /northstar/Common/NorthFileManager/fileManagerObjects.jsp endpoint until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-29398

Affected Products

Northstar Club Management

References · 5

• https://osv.dev/vulnerability/CVE-2021-29398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29398 · Security Note
• https://ardent-security.com · Note
• https://t.me/cibsecurity/36877 · Telegram Post
• https://ardent-security.com/en/advisory/asa-2021-06 · Note