#VU25460 Path traversal in SyncServer - CVE-2020-9029
Published: February 19, 2020
Vulnerability identifier: #VU25460
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-9029
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
SyncServer
SyncServer
Software vendor:
Microsemi
Microsemi
Description
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to insufficient sanitization of user-supplied passed via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user). A remote attacker can send a specially crafted HTTP request containing directory traversal sequences and read contents of arbitrary files on the system.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.