CVE-2020-15712: Path Traversal

Published Jul 28, 2020

Updated

rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByPath.php script containing hexadecimal encoded "dot dot" sequences (%2f..%2f) in the path parameter to view arbitrary files on the system.

Affected Software

1 affected component

rConfig rConfig=3.9.5

Event History

Jul 28, 2020

CVE Published

via MITRE·01:03 PM

Data Sourced

via MITRE·01:03 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-15712?

The severity of CVE-2020-15712 is medium with a severity value of 4.3.

How does CVE-2020-15712 affect rConfig?

CVE-2020-15712 affects rConfig version 3.9.5.

What is the CWE classification of CVE-2020-15712?

CVE-2020-15712 is classified under CWE-22 (Path Traversal).

How can CVE-2020-15712 be exploited?

An attacker can exploit CVE-2020-15712 by sending a crafted request to the ajaxGetFileByPath.php script with hexadecimal encoded "dot dot" sequences in the path parameter.

Are there any references for CVE-2020-15712?

Yes, you can find more information about CVE-2020-15712 at the following references: [Reference 1](https://exchange.xforce.ibmcloud.com/vulnerabilities/184938) and [Reference 2](https://www.rconfig.com/downloads/v3-release-notes).