CVE-2017-2090 Path traversal in Cybozu Garoon

What is CVE-2017-2090?

CVE-2017-2090 is a medium-severity path traversal vulnerability in Cybozu, Inc. Cybozu Garoon, published on 28 Apr 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors.

Weakness: CWE-22

Which versions are affected by CVE-2017-2090?

It affects 1 product.

Products include Cubecart Cubecart.

How do I fix CVE-2017-2090?

No fix has been published for CVE-2017-2090 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2017-2090 being exploited?

There is no known exploitation of CVE-2017-2090 in the wild and no public exploit code.

Other vulnerabilities in Cybozu, Inc. Cybozu Garoon

• CVE-2024-34832 Path traversal in n/a Critical 9.8
• CVE-2018-20716 SQL injection in n/a Critical 9.8
• CVE-2013-1465 Deserialization in n/a Critical 9.8
• CVE-2026-21719 Command injection in CubeCart High 8.6
• CVE-2023-38130 Cross-site request forgery in CubeCart High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vfq3-fw8h-whv2.