CVE-2020-4125 Path traversal in "HCL Marketing Operations"
Attackers can download confidential files from the RHEL environment by modifying links in HCL Marketing Operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4125?
CVE-2020-4125 is a high-severity path traversal vulnerability in "HCL Marketing Operations", published on 20 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to confidential information.
Weakness: CWE-494
Which versions are affected by CVE-2020-4125?
It affects 1 product.
Products include Ibm Marketing Operations.
How do I fix CVE-2020-4125?
No fix has been published for CVE-2020-4125 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-4125 being exploited?
There is no known exploitation of CVE-2020-4125 in the wild and no public exploit code.
Other vulnerabilities in "HCL Marketing Operations"
Sources
Also known as GHSA-3587-wxgr-vm9r.