CVE-2014-0358 Path traversal in n/a
Remote attackers can read arbitrary files via directory traversal in Xangati XSR and XNR servers without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-0358?
CVE-2014-0358 is a high-severity path traversal vulnerability in n/a, published on 15 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.
Weakness: CWE-22
Which versions are affected by CVE-2014-0358?
It affects 2 products.
Products include Xangati Xangati Software Release, Xangati Xangati Xnr.
How do I fix CVE-2014-0358?
No fix has been published for CVE-2014-0358 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-0358 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-0358 exists.
Public exploit code: 3 Exploit-DB entries.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qfvv-m62h-vvgf.