CVE-2020-9353: Path Traversal
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML element in the transaction parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Protect the tools path with normal web-server authentication and authorization mechanisms so only administrators/end users can access the affected functionality (e.g., requests to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall).
SmartClient tools web paths (e.g., /tools/developerConsoleOperations.jsp or /isomorphic/IDACall) Access control for tools path = restricted to administrators or end users via authentication and authorization - Compensating control
Deploy SmartClient 12.0 tools only into a trusted environment, as the affected console functionality is accessible via publicly reachable paths by default per the documentation note.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9353?
CVE-2020-9353 has a medium severity rating due to its potential for unauthenticated local file inclusion.
How do I fix CVE-2020-9353?
To fix CVE-2020-9353, upgrade to a version of SmartClient that has patched this vulnerability.
What software is affected by CVE-2020-9353?
CVE-2020-9353 specifically affects SmartClient version 12.0.
What type of vulnerability is CVE-2020-9353?
CVE-2020-9353 is a local file inclusion vulnerability that can be exploited via directory traversal.
Are there any known exploits for CVE-2020-9353?
Yes, CVE-2020-9353 can be exploited by attackers to access files on the server without authentication.