CVE-2019-15032 Information disclosure in n/a
Attackers can obtain sensitive internal server information via error messages when unauthenticated uploads are enabled with remote upload options.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15032?
CVE-2019-15032 is a medium-severity vulnerability in n/a, published on 19 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.
Weakness: CWE-209
Which versions are affected by CVE-2019-15032?
It affects 1 product.
Products include Pydio Pydio.
How do I fix CVE-2019-15032?
No fix has been published for CVE-2019-15032 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15032 being exploited?
There is no known exploitation of CVE-2019-15032 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rchv-vfvq-x3hp.