Path traversal in Enterprise NFV Infrastructure Software - CVE-2020-3236
Published: June 23, 2020
Vulnerability identifier: #VU29214
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3236
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in the CLI command arguments. A local user can send a specially crafted HTTP request, gain root shell access to the underlying operating system and overwrite or read arbitrary files on an affected device.
Affected software
Enterprise NFV Infrastructure Software
How to mitigate CVE-2020-3236
Install update from vendor's website.
Enterprise NFV Infrastructure Software - update to 4.1.1