Download of Code Without Integrity Check
CVE-2021-41714
Summary
In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.
- LOW
- NETWORK
- NONE
- CHANGED
- NONE
- LOW
- HIGH
- NONE
CWE-494 - Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
References
Advisory Timeline
- Published
