CVE-2014-6308: Path Traversal

Q: Which deployments are affected?

OSClass versions before 3.4.2 are affected. The issue is reachable remotely through the render action in oc-admin/index.php.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication and can exploit the issue over the network. Exploitation involves placing directory-traversal sequences such as .. in the file parameter.

Q: What is the impact of successful exploitation?

Successful exploitation allows an attacker to read arbitrary files accessible to the affected OSClass installation.

Q: What is the available remediation?

Upgrade OSClass to version 3.4.2 or later. The vulnerability affects releases before 3.4.2.

Published Oct 20, 2014

Updated

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.

Affected Software

2 affected components

OSClass Osclass<=3.4.1

OSClass Osclass=3.4.0

Event History

Oct 20, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

Which deployments are affected?

OSClass versions before 3.4.2 are affected. The issue is reachable remotely through the render action in oc-admin/index.php.

What does an attacker need to exploit this issue?

An attacker does not need authentication and can exploit the issue over the network. Exploitation involves placing directory-traversal sequences such as .. in the file parameter.

What is the impact of successful exploitation?

Successful exploitation allows an attacker to read arbitrary files accessible to the affected OSClass installation.

What is the available remediation?

Upgrade OSClass to version 3.4.2 or later. The vulnerability affects releases before 3.4.2.

CVE-2014-6308: Path Traversal

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What is the available remediation?