SB2018103120 - Multiple vulnerabilities in TecRail Responsive FileManager
Published: October 31, 2018 Updated: August 8, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Path traversal (CVE-ID: CVE-2018-20789)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary directory as a consequence of a paths[0] path traversal mitigation bypass through the delete_folder action in execute.php.
2) Path traversal (CVE-ID: CVE-2018-20790)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
tecrail Responsive FileManager 9.13.4 allows remote attackers to delete an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass through the delete_file action in execute.php.
3) Cross-site scripting (CVE-ID: CVE-2018-20791)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Path traversal (CVE-ID: CVE-2018-20792)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the get_file action in ajax_calls.php.
5) Path traversal (CVE-ID: CVE-2018-20793)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary file as a consequence of a paths[0] path traversal mitigation bypass, through the create_file action in execute.php.
6) Path traversal (CVE-ID: CVE-2018-20794)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the path parameter, through the save_img action in ajax_calls.php.
7) Path traversal (CVE-ID: CVE-2018-20795)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary files via path traversal with the path parameter, through the copy_cut action in ajax_calls.php and the paste_clipboard action in execute.php.
8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2018-18867)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.