CVE-2023-6352 Aquaforest TIFF Server default configuration allows access to arbitrary files
Remote attackers can access arbitrary files and bypass authentication due to insecure default configurations in Aquaforest TIFF Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6352?
CVE-2023-6352 is a medium-severity path traversal vulnerability in Aquaforest TIFF Server, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.
Weakness: CWE-22
Which versions are affected by CVE-2023-6352?
It affects 1 product.
Products include Aquaforest Tiff Server.
How do I fix CVE-2023-6352?
No fix has been published for CVE-2023-6352 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-6352 being exploited?
There is no known exploitation of CVE-2023-6352 in the wild and no public exploit code.
Other vulnerabilities in Aquaforest TIFF Server
Sources
Also known as GHSA-vrfq-g4fq-7qwr.