Path traversal in libslirp - CVE-2020-7211
Published: February 19, 2020 / Updated: April 28, 2020
Vulnerability identifier: #VU25457
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-7211
CWE-ID: CWE-22
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: Freedesktop.org
Affected software:
libslirp
libslirp
Detailed vulnerability description
The vulnerability allows an attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within tftp.c in libslirp. A remote attacker can send a specially crafted TFPT request and read arbitrary files on the Windows system.
How to mitigate CVE-2020-7211
Install update from vendor's website.