CVE-2014-2575

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:*:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.3:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.4:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.5:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.6:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.8:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.9:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.10:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:10.2.11:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.4:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.5:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.6:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.7:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.8:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.9:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.10:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.11:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.1.12:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.5:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.7:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.8:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.10:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.11:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.12:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.13:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:11.2.14:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.4:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.5:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.6:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.7:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.8:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.9:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.10:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.11:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.1.12:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.4:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.5:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.6:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.7:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.8:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.10:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.11:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.12:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.13:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.15:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:12.2.16:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.1:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.1.4:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.1.5:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.1.6:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.1.7:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.1.8:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.2:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.2.5:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.2.6:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.2.7:*:*:*:*:*:*:*
cpe:2.3:a:devexpress:aspxfilemanager_control_for_webforms_and_mvc:13.2.8:*:*:*:*:*:*:*

History

21 Nov 2024, 02:06

Type Values Removed Values Added
References () http://osvdb.org/show/osvdb/107742 - () http://osvdb.org/show/osvdb/107742 -
References () http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2.8-Directory-Traversal.html - () http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2.8-Directory-Traversal.html -
References () http://seclists.org/fulldisclosure/2014/Jun/24 - Exploit () http://seclists.org/fulldisclosure/2014/Jun/24 - Exploit
References () http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2 - Vendor Advisory () http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2 - Vendor Advisory
References () http://www.exploit-db.com/exploits/33700 - () http://www.exploit-db.com/exploits/33700 -
References () http://www.securityfocus.com/archive/1/532304/100/0/threaded - () http://www.securityfocus.com/archive/1/532304/100/0/threaded -
References () http://www.securityfocus.com/bid/67902 - () http://www.securityfocus.com/bid/67902 -
References () https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-006/-directory-traversal-in-devexpress-asp-net-file-manager - Exploit () https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-006/-directory-traversal-in-devexpress-asp-net-file-manager - Exploit

Information

Published : 2014-06-06 14:55

Updated : 2024-11-21 02:06


NVD link : CVE-2014-2575

Mitre link : CVE-2014-2575

CVE.ORG link : CVE-2014-2575


JSON object : View

Products Affected

devexpress

  • aspxfilemanager_control_for_webforms_and_mvc
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')