CVE-2014-2352: Cogent DataHub Path Traversal

Q: What is the severity of CVE-2014-2352?

CVE-2014-2352 has a medium severity level due to its potential for arbitrary file access and web server denial of service.

Q: How do I fix CVE-2014-2352?

To fix CVE-2014-2352, upgrade to Cogent DataHub version 7.3.5 or later.

Q: What impact can an attacker have by exploiting CVE-2014-2352?

An attacker exploiting CVE-2014-2352 can read sensitive files or cause a denial of service in the web server.

Q: Which versions of Cogent DataHub are affected by CVE-2014-2352?

CVE-2014-2352 affects Cogent DataHub versions prior to 7.3.5, including versions from 7.0 to 7.3.4.

Q: Is CVE-2014-2352 a denial of service vulnerability?

Yes, CVE-2014-2352 can be exploited to cause a denial of service in the affected web server.

Published May 30, 2014

Updated

Directory traversal vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to read arbitrary files of unspecified types, or cause a web-server denial of service, via a crafted pathname.

Other sources

The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable an attacker to access a limited number of hardcoded file types. Further exploitation of this vulnerability may allow an attacker to cause the web server component to enter a denial-of-service condition.

— MITRE

Affected Software

12 affected components

Cogentdatahub Cogent Datahub<=7.3.4

Cogentdatahub Cogent Datahub=7.0

Cogentdatahub Cogent Datahub=7.0.2

Cogentdatahub Cogent Datahub=7.1.0

Cogentdatahub Cogent Datahub=7.1.1

Cogentdatahub Cogent Datahub=7.1.1.63

Cogentdatahub Cogent Datahub=7.1.2

Cogentdatahub Cogent Datahub=7.2.2

Cogentdatahub Cogent Datahub=7.3.0

Cogentdatahub Cogent Datahub=7.3.1

Cogentdatahub Cogent Datahub=7.3.2

Cogentdatahub Cogent Datahub=7.3.3

Remediation

Information

Cogent Real-Time Systems, Inc. has produced a new version of the Cogent DataHub application, Version 7.3.5, that fixes three of the four identified vulnerabilities. The updated version is available at the following address: http://cogentdatahub.com/Download_Software.html Cogent has indicated that it will not be fixing the cryptographic weaknesses of hashed usernames and passwords because of compatibility issues with existing systems. Cogent and the researcher agree that an effective mitigation strategy for users is to select sufficiently strong passwords. Cogent has indicated that password hashes can be checked for strength using sites such as: https://crackstation.net/ .

Event History

May 30, 2014

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2352?

CVE-2014-2352 has a medium severity level due to its potential for arbitrary file access and web server denial of service.

How do I fix CVE-2014-2352?

To fix CVE-2014-2352, upgrade to Cogent DataHub version 7.3.5 or later.

What impact can an attacker have by exploiting CVE-2014-2352?