CVE-2020-14946 Path traversal in n/a
Attackers can view local sensitive files on the web server by manipulating FileName and FilePath parameters in the downloadFile.ashx endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14946?
CVE-2020-14946 is a medium-severity path traversal vulnerability in n/a, published on 22 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath parameters in the URL, or while using a proxy. This vulnerability could be used to view local sensitive files or configuration files.
Weakness: CWE-22
Which versions are affected by CVE-2020-14946?
It affects 1 product.
Products include Globalradar Bsa Radar.
How do I fix CVE-2020-14946?
No fix has been published for CVE-2020-14946 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-14946 being exploited?
There is no known exploitation of CVE-2020-14946 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cxxh-cfm2-r8pj.