Описание
File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.
Ссылки
EPSS
Процентиль: 31%
0.00378
Низкий
6.3 Medium
CVSS3
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 6.3
github
около 2 месяцев назад
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
EPSS
Процентиль: 31%
0.00378
Низкий
6.3 Medium
CVSS3
Дефекты
CWE-22