CVE-2018-12909: Path Traversal
DISPUTED Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12909?
The severity of CVE-2018-12909 is considered to be medium due to its reliance on user input to access local filesystem files.
How do I fix CVE-2018-12909?
To fix CVE-2018-12909, restrict access to the Webgrind application to trusted users and properly validate any user inputs.
What versions of Webgrind are affected by CVE-2018-12909?
CVE-2018-12909 affects Webgrind version 1.5.0 specifically.
Can CVE-2018-12909 be exploited remotely?
Yes, CVE-2018-12909 can be exploited remotely if the Webgrind application is accessible publicly.
Is there an official vendor response to CVE-2018-12909?
The vendor has indicated that Webgrind is not intended for a publicly accessible environment, disputing the vulnerability's context.