CVE-2014-8741

Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://support.lexmark.com/index?page=content&id=TE666	Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-14-410/	Third Party Advisory VDB Entry
http://support.lexmark.com/index?page=content&id=TE666	Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-14-410/	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:lexmark:markvision_enterprise:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:19

Type	Values Removed	Values Added
References	~~() http://support.lexmark.com/index?page=content&id=TE666 - Vendor Advisory~~	() http://support.lexmark.com/index?page=content&id=TE666 - Vendor Advisory
References	~~() http://www.zerodayinitiative.com/advisories/ZDI-14-410/ - Third Party Advisory, VDB Entry~~	() http://www.zerodayinitiative.com/advisories/ZDI-14-410/ - Third Party Advisory, VDB Entry

Information

Published : 2020-01-27 18:15

Updated : 2024-11-21 02:19

NVD link : CVE-2014-8741

Mitre link : CVE-2014-8741

CVE.ORG link : CVE-2014-8741

JSON object : View

Products Affected

lexmark

markvision_enterprise

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2014-8741", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-01-27T18:15:11.117", "references": [{"url": "http://support.lexmark.com/index?page=content&id=TE666", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-410/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://support.lexmark.com/index?page=content&id=TE666", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-410/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors."}, {"lang": "es", "value": "Una vulnerabilidad de salto de directorio en el servlet GfdFileUploadServerlet en Lexmark MarkVision Enterprise versiones anteriores a 2.1, permite a atacantes remotos escribir en archivos arbitrarios por medio de vectores no especificados."}], "lastModified": "2024-11-21T02:19:40.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lexmark:markvision_enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3A246B3-1C6B-435B-84D6-969FB399A7C8", "versionEndExcluding": "2.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}