CVE-2020-11798 Path traversal in n/a
An attacker can access arbitrary files from restricted directories via a crafted URL, exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11798?
CVE-2020-11798 is a medium-severity path traversal vulnerability in n/a, published on 10 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
Weakness: CWE-22
Which versions are affected by CVE-2020-11798?
It affects 1 product.
Products include Mitel Micollab Audio\, Web \& Video Conferencing.
How do I fix CVE-2020-11798?
No fix has been published for CVE-2020-11798 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-11798 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-11798 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-25p6-jmrr-3hj2.