CVE-2022-27906 Path traversal in n/a
An attacker with a valid Odette ID can upload files outside the intended directory via path traversal in Mendelson OFTP2.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27906?
CVE-2022-27906 is a medium-severity path traversal vulnerability in n/a, published on 25 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.
Weakness: CWE-22
Which versions are affected by CVE-2022-27906?
It affects 1 product.
Products include Mendelson Oftp2.
How do I fix CVE-2022-27906?
No fix has been published for CVE-2022-27906 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-27906 being exploited?
There is no known exploitation of CVE-2022-27906 in the wild and no public exploit code.
Sources
Also known as GHSA-fxrm-2v78-3qr9.