CVE-2023-42129: A10 Thunder ADC ShowTechDownloadView Directory Traversal Information Disclosure Vulnerability

Q: What is the severity of CVE-2023-42129?

CVE-2023-42129 has been classified as a medium severity information disclosure vulnerability.

Q: How do I fix CVE-2023-42129?

To fix CVE-2023-42129, users should apply the latest security patches provided by A10 Networks for the Thunder ADC product.

Q: What are the potential impacts of CVE-2023-42129?

The potential impacts of CVE-2023-42129 include unauthorized access to sensitive information if exploited by an authenticated user.

Q: Is authentication required to exploit CVE-2023-42129?

Yes, authentication is required to exploit CVE-2023-42129, meaning that an attacker must have valid access to the affected system.

Q: Which product is affected by CVE-2023-42129?

CVE-2023-42129 affects the A10 Thunder ADC product from A10 Networks.

Published May 3, 2024

Updated

A10 Thunder ADC ShowTechDownloadView Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ShowTechDownloadView class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. . Was ZDI-CAN-17899.

Affected Software

27 affected components

A10 Thunder ADC

All of the following

Any of the following

A10networks Advanced Core Operating System>=5.1.0<5.2.1

A10networks Advanced Core Operating System>=6.0.0<6.0.2

A10networks Advanced Core Operating System=4.1.4

A10networks Advanced Core Operating System=4.1.4-gr1

A10networks Advanced Core Operating System=4.1.4-gr1-p1

A10networks Advanced Core Operating System=4.1.4-gr1-p10

A10networks Advanced Core Operating System=4.1.4-gr1-p11

A10networks Advanced Core Operating System=4.1.4-gr1-p12

A10networks Advanced Core Operating System=4.1.4-gr1-p2

A10networks Advanced Core Operating System=4.1.4-gr1-p3

A10networks Advanced Core Operating System=4.1.4-gr1-p4

A10networks Advanced Core Operating System=4.1.4-gr1-p5

A10networks Advanced Core Operating System=4.1.4-gr1-p6

A10networks Advanced Core Operating System=4.1.4-gr1-p7

A10networks Advanced Core Operating System=4.1.4-gr1-p8

A10networks Advanced Core Operating System=4.1.4-gr1-p9

A10networks Advanced Core Operating System=5.2.1

A10networks Advanced Core Operating System=5.2.1-p1

A10networks Advanced Core Operating System=5.2.1-p2

A10networks Advanced Core Operating System=5.2.1-p3

A10networks Advanced Core Operating System=5.2.1-p4

A10networks Advanced Core Operating System=5.2.1-p5

A10networks Advanced Core Operating System=5.2.1-p6

A10networks Advanced Core Operating System=5.2.1-p7

A10networks Advanced Core Operating System=5.2.1-p8

A10networks Thunder Application Delivery Controller

Event History

May 3, 2024

CVE Published

via MITRE·02:13 AM

Data Sourced

via MITRE·02:13 AM

DescriptionSeverityWeakness

Advisory Published

via ZDI·02:31 AM

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-42129?

CVE-2023-42129 has been classified as a medium severity information disclosure vulnerability.

How do I fix CVE-2023-42129?

To fix CVE-2023-42129, users should apply the latest security patches provided by A10 Networks for the Thunder ADC product.

What are the potential impacts of CVE-2023-42129?

The potential impacts of CVE-2023-42129 include unauthorized access to sensitive information if exploited by an authenticated user.

Is authentication required to exploit CVE-2023-42129?

Yes, authentication is required to exploit CVE-2023-42129, meaning that an attacker must have valid access to the affected system.

Which product is affected by CVE-2023-42129?