CVE-2014-3777: Path Traversal
Published Jul 16, 2014
·Updated
Directory traversal vulnerability in Reportico PHP Report Designer before 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the xmlin parameter.
Affected Software
22 affected components
Reportico PHP Report Designer<=3.3
Reportico PHP Report Designer=1.0.0
Reportico PHP Report Designer=1.0.1
Reportico PHP Report Designer=1.0.2
Reportico PHP Report Designer=1.0.3
Reportico PHP Report Designer=1.0.4
Reportico PHP Report Designer=1.0.5
Reportico PHP Report Designer=1.0.6
Reportico PHP Report Designer=2.0
Reportico PHP Report Designer=2.0.1
Reportico PHP Report Designer=2.1
Reportico PHP Report Designer=2.2
Reportico PHP Report Designer=2.3
Reportico PHP Report Designer=2.3.1
Reportico PHP Report Designer=2.4
Reportico PHP Report Designer=2.4-beta
Reportico PHP Report Designer=2.5
Reportico PHP Report Designer=2.6
Reportico PHP Report Designer=2.7
Reportico PHP Report Designer=3.0
Reportico PHP Report Designer=3.1
Reportico PHP Report Designer=3.2
Event History
Jul 16, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3777?
CVE-2014-3777 is classified as a medium severity vulnerability due to its potential to allow unauthorized file access.
2
How do I fix CVE-2014-3777?
To fix CVE-2014-3777, users should upgrade to Reportico PHP Report Designer version 4.0 or later.
3
What types of attacks does CVE-2014-3777 enable?
CVE-2014-3777 enables directory traversal attacks, allowing remote attackers to read arbitrary files on the server.
4
Which versions of Reportico are affected by CVE-2014-3777?
All versions of Reportico PHP Report Designer before 4.0, including 1.0.0 through 3.3, are affected by CVE-2014-3777.
5
Is CVE-2014-3777 easy to exploit?
Exploiting CVE-2014-3777 is relatively straightforward, as it requires only the manipulation of the xmlin parameter in a request.