Description

iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.

Remediation

References

https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd

https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634

Related Vulnerabilities

CVE-2021-21361 Vulnerability in maven package com.bmuschko:gradle-vagrant-plugin

CVE-2022-47551 Vulnerability in maven package io.apiman:apiman-manager-api-rest-impl

CVE-2012-4534 Vulnerability in maven package org.apache.tomcat:coyote

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.vitotronic

CVE-2019-12423 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-jose

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit