Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.
References
| Link | Resource |
|---|---|
| https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/ | Technical Description Third Party Advisory |
| https://mendelson-e-c.com/node/3355 | Release Notes Vendor Advisory |
| https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/ | Technical Description Third Party Advisory |
| https://mendelson-e-c.com/node/3355 | Release Notes Vendor Advisory |
Configurations
History
21 Nov 2024, 06:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/ - Technical Description, Third Party Advisory | |
| References | () https://mendelson-e-c.com/node/3355 - Release Notes, Vendor Advisory |
Information
Published : 2022-03-25 20:15
Updated : 2024-11-21 06:56
NVD link : CVE-2022-27906
Mitre link : CVE-2022-27906
CVE.ORG link : CVE-2022-27906
JSON object : View
Products Affected
mendelson
- oftp2
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')