Описание
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
Уязвимые конфигурации
Конфигурация 1Версия до 2026.2 (исключая)
cpe:2.3:a:ivanti:xtraction:*:*:*:*:*:*:*:*
EPSS
Процентиль: 55%
0.00869
Низкий
9.6 Critical
CVSS3
Дефекты
CWE-73
Связанные уязвимости
CVSS3: 9.6
github
3 месяца назад
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
EPSS
Процентиль: 55%
0.00869
Низкий
9.6 Critical
CVSS3
Дефекты
CWE-73