External Control of File Name or Path

CVE-2022-25098

High

9.1/10

Summary

ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.

Attack Complexity: LOW
Attack Vector: NETWORK
Integrity Impact: HIGH
Scope: UNCHANGED
User Interaction: NONE
Privileges Required: NONE
Confidentiality Impact: NONE
Availability Impact: HIGH

CWE-73 - External Control of File Name or Path

The software allows user input to control or influence paths or file names that are used in filesystem operations.

References

Advisory

Advisory Timeline

Published Feb 24, 2022