CVE-2022-39812: Path Traversal
Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request (not possible using the GUI) to an arbitrary directory. Because the application does not check in which directory a file will be uploaded, an attacker can perform a variety of attacks that can result in unauthorized access to the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39812?
CVE-2022-39812 is classified as a high severity vulnerability due to its potential for absolute path traversal.
How do I fix CVE-2022-39812?
The recommended fix for CVE-2022-39812 is to update to a patched version of Italtel NetMatch-S CI that addresses this vulnerability.
What is the impact of CVE-2022-39812?
CVE-2022-39812 allows unauthenticated users to upload files to arbitrary directories, potentially leading to malicious file execution.
Which version of Italtel NetMatch-S CI is vulnerable to CVE-2022-39812?
CVE-2022-39812 affects Italtel NetMatch-S CI version 5.2.0-20211008.
Can CVE-2022-39812 be exploited remotely?
Yes, CVE-2022-39812 can be exploited remotely by an unauthenticated attacker who manipulates the uploadDir parameter.