PT-2024-11707 · Unknown · Lenderd 1003 Mortgage Application

Rodrigo Escobar · Published 2024-05-17 · Updated 2024-07-09 · CVE-2022-45368

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lenderd 1003 Mortgage Application versions 1.75 and earlier

Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows Relative Path Traversal. This enables remote attacks. The estimated number of potentially affected devices is not specified.

Recommendations For versions 1.75 and earlier, update to a version that contains a fix for this issue to protect against severe path traversal vulnerability. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation. Review logs for signs of exploit to identify potential security breaches.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-45368

Affected Products

Lenderd 1003 Mortgage Application

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-45368 · Security Note
• https://twitter.com/oktsec/status/1810873974609387836 · Twitter Post
• https://t.me/cvenotify/80184 · Telegram Post
• https://twitter.com/CVEnew/status/1791391021903032603 · Twitter Post
• https://twitter.com/linuxpatch/status/1791379844611072057 · Twitter Post
• https://patchstack.com/database/vulnerability/1003-mortgage-application/wordpress-1003-mortgage-application-plugin-1-73-local-file-inclusion?_s_id=cve · Note