Skip to main content

Path Equivalence: 'fakedir/../realdir/filename'

CVE-2024-34995

Medium
4.3/10

Summary

svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOver. This vulnerability allows attackers to delete arbitrary files via a crafted POST request.

  • LOW
  • PHYSICAL
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-57 - Path Equivalence: 'fakedir/../realdir/filename'

The software contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

References

Advisory Timeline

  • Published