CVE-2018-7807: Path Traversal
Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could allow for the arbitrary upload of files contained with the zip onto the server file system outside of the intended directory. This is leveraging the more commonly known ZipSlip vulnerability within Java code.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-7807?
CVE-2018-7807 is a vulnerability in Schneider-electric Struxureware Data Center Expert versions 7.5.0 and earlier.
What is the severity of CVE-2018-7807?
The severity of CVE-2018-7807 is high, with a severity value of 8.8.
How does CVE-2018-7807 affect Schneider-electric Struxureware Data Center Expert?
CVE-2018-7807 allows for the upload of a zip file from the user interface, potentially allowing the upload of a malicious file with path traversal file names.
Which versions of Schneider-electric Struxureware Data Center Expert are affected by CVE-2018-7807?
CVE-2018-7807 affects versions 7.5.0 and earlier of Schneider-electric Struxureware Data Center Expert.
How can CVE-2018-7807 be fixed?
To fix CVE-2018-7807, upgrade to version 7.6.0 of Schneider-electric Struxureware Data Center Expert.