02 Oct 2019
Vulnérabilité CVE-2019-13343 CVE Vulnerability
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...&h= substring followed by a filename. (CVSS:5.0) (Last Update:2019-10-08)
Vulnerability Details : Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...&h= substring followed by a filename. Publish Date : 2019-10-02 Last Update Date : 2019-10-08 - CVSS Scores & Vulnerability Types
- Products Affected By CVE-2019-13343- Number Of Affected Versions By Product
- References For CVE-2019-13343 | ||||||||||||||||||||||||||||||||
- Metasploit Modules Related To CVE-2019-13343There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information) |