CVE-2020-7211 Path traversal in n/a
An attacker can exploit a directory traversal flaw in libslirp's TFTP implementation on Windows to read or modify arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7211?
CVE-2020-7211 is a high-severity path traversal vulnerability in Qemu Qemu, published on 21 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
Weakness: CWE-22
Which versions are affected by CVE-2020-7211?
It affects 2 products.
Products include Libslirp Project Libslirp, Qemu Qemu.
How do I fix CVE-2020-7211?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-7211 being exploited?
There is no known exploitation of CVE-2020-7211 in the wild and no public exploit code.
Other vulnerabilities in Qemu Qemu
Sources
Also known as DEBIAN-CVE-2020-7211, GHSA-g6ww-98w5-h2gm.