Vulnerability GHSA-rrhw-54r8-545q
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 years ago
May 25, 2022 at 12:00 AM UTC
Path Traversal in FileGator
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2
Summary
Path Traversal in FileGator
Details
Path Traversal in FileGator prior to 7.8.0 for non-admin users. Files created with ..\ as part of their name will be interpreted as a path. Users are thus able to add filesystem entries outside the scope of their user to their dashboard and subsequently are able to modify those files.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
7 hours ago
FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2 and v7.8.0 and v7.8.1 and v7.8.2 and v7.8.3 and v7.8.4 and v7.8.5 and v7.8.6 and v7.8.7 and v7.9.0 and v7.9.1 and v7.9.2 and v7.9.3 and v7.10.0 and v7.10.1 and v7.11.0 and v7.11.1 and v7.12.0 and v7.13.0 and v7.13.1 and v7.13.2 and v7.13.3 and v7.13.4 and v7.13.5 and v7.14.0 and v7.14.1 and v7.14.2 and v7.14.3 and v7.14.4 GHSA-44r8-3p76-84mw
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2 and v7.8.0 and v7.8.1 and v7.8.2 and v7.8.3 and v7.8.4 and v7.8.5 and v7.8.6 and v7.8.7 and v7.9.0 and v7.9.1 and v7.9.2 and v7.9.3 and v7.10.0 and v7.10.1 and v7.11.0 and v7.11.1 and v7.12.0 and v7.13.0 and v7.13.1 and v7.13.2 and v7.13.3 and v7.13.4 and v7.13.5 and v7.14.0 and v7.14.1 and v7.14.2 and v7.14.3 and v7.14.4 GHSA-44r8-3p76-84mw
Medium Risk
7 hours ago
FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2 and v7.8.0 and v7.8.1 and v7.8.2 and v7.8.3 and v7.8.4 and v7.8.5 and v7.8.6 and v7.8.7 and v7.9.0 and v7.9.1 and v7.9.2 and v7.9.3 and v7.10.0 and v7.10.1 and v7.11.0 and v7.11.1 and v7.12.0 and v7.13.0 and v7.13.1 and v7.13.2 and v7.13.3 and v7.13.4 and v7.13.5 and v7.14.0 and v7.14.1 and v7.14.2 and v7.14.3 and v7.14.4 GHSA-f74m-x83r-c4v4
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2 and v7.8.0 and v7.8.1 and v7.8.2 and v7.8.3 and v7.8.4 and v7.8.5 and v7.8.6 and v7.8.7 and v7.9.0 and v7.9.1 and v7.9.2 and v7.9.3 and v7.10.0 and v7.10.1 and v7.11.0 and v7.11.1 and v7.12.0 and v7.13.0 and v7.13.1 and v7.13.2 and v7.13.3 and v7.13.4 and v7.13.5 and v7.14.0 and v7.14.1 and v7.14.2 and v7.14.3 and v7.14.4 GHSA-f74m-x83r-c4v4
Medium Risk
4 years ago
Improper user session handling in filegator
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2 GHSA-47vg-483w-hp3m
v7.0.0-RC1 and v7.0.0-RC2 and v7.0.0-RC3 and v7.0.0 and v7.0.1 and v7.1.0 and v7.1.1 and v7.1.2 and v7.1.3 and v7.1.4 and v7.1.5 and v7.1.6 and v7.2.0 and v7.2.1 and v7.3.0 and v7.3.1 and v7.3.2 and v7.3.3 and v7.3.4 and v7.3.5 and v7.4.0 and v7.4.1 and v7.4.2 and v7.4.3 and v7.4.4 and v7.4.5 and v7.4.6 and v7.4.7 and v7.5.0 and v7.5.1 and v7.5.2 and v7.5.3 and v7.6.0 and v7.7.0 and v7.7.1 and v7.7.2 GHSA-47vg-483w-hp3m
Impacted packages
Timeline
Published
4 years ago
May 25, 2022 at 12:00 AM UTC
Last Modified
3 years ago
November 08, 2023 at 04:07 AM UTC