CVE-2022-1359 Cambium Networks cnMaestro Path Traversal
Attackers can write arbitrary files to the server via path traversal in cnMaestro, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-1359?
CVE-2022-1359 is a medium-severity path traversal vulnerability in Cambium Networks cnMaestro, published on 17 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specific route. If an attacker supplied path traversal charters (../) as part of a filename, the server will save the file where the attacker chooses. This could allow an attacker to write any data to any file in the server.
Which versions are affected by CVE-2022-1359?
It affects 1 product.
Products include Cambiumnetworks Cnmaestro.
How do I fix CVE-2022-1359?
No fix has been published for CVE-2022-1359 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-1359 being exploited?
There is no known exploitation of CVE-2022-1359 in the wild and no public exploit code.
Other vulnerabilities in Cambium Networks cnMaestro
- CVE-2022-1357 Cambium Networks cnMaestro OS Command Injection
- CVE-2022-1360 Cambium Networks cnMaestro OS Command Injection
- CVE-2022-1361 Cambium Networks cnMaestro SQL Injection
- CVE-2022-1356 Cambium Networks cnMaestro use of Potentially Dangerous Function
- CVE-2022-1358 Cambium Networks cnMaestro SQL Injection
Sources
Also known as GHSA-qpf9-w85c-45gv.