CVE-2022-29597 Path traversal in n/a
Authenticated users can exploit Local File Inclusion to read arbitrary internal system files and source code from the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-29597?
CVE-2022-29597 is a medium-severity path traversal vulnerability in n/a, published on 2 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). Any authenticated user has the ability to reference internal system files within requests made to the RRSWeb/maint/ShowDocument/ShowDocument.aspx page. The server will successfully respond with the file contents of the internal system file requested. This ability could allow for adversaries to extract sensitive data and/or files from the underlying file system, gain knowledge about the internal workings of the system, or access source code of the application.
Weakness: CWE-22
Which versions are affected by CVE-2022-29597?
It affects 1 product.
Products include Solutions-Atlantic Regulatory Reporting System.
How do I fix CVE-2022-29597?
No fix has been published for CVE-2022-29597 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-29597 being exploited?
There is no known exploitation of CVE-2022-29597 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h22c-hr28-7qxw.