CVE-2020-6932 Path traversal in QNX Software Development Platform (SDP)
An attacker can read arbitrary files and execute code on the QNX SDP slinger web server via path traversal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6932?
CVE-2020-6932 is a critical path traversal vulnerability in BlackBerry QNX Software Development Platform (SDP), published on 12 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow an attacker to potentially read arbitrary files and run arbitrary executables in the context of the web server.
Weakness: CWE-150
Which versions are affected by CVE-2020-6932?
It affects 1 product.
Products include Blackberry Qnx Software Development Platform.
How do I fix CVE-2020-6932?
No fix has been published for CVE-2020-6932 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-6932 being exploited?
There is no known exploitation of CVE-2020-6932 in the wild and no public exploit code.
Other vulnerabilities in BlackBerry QNX Software Development Platform (SDP)
- CVE-2025-2474 Vulnerability in PCX Image Codec Impacts QNX Software Development Platform
- CVE-2024-48856 Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform
- CVE-2021-32024 Memory corruption in QNX Software Development Platform (SDP)
- CVE-2017-3891 Privilege escalation in QNX Software Development Platform (QNX SDP)
- CVE-2024-35213 Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)
Sources
Also known as GHSA-chqw-c679-9rg5.