Path traversal in Illumina products - CVE-2022-1518
Published: June 3, 2022
Vulnerability identifier: #VU63960
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2022-1518
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Illumina
Affected software:
In Vitro Diagnostic NextSeq 550Dx
In Vitro Diagnostic MiSeq Dx
NextSeq 500 Instrument
NextSeq 550 Instrument
MiSeq Instrument
iSeq 100 Instrument
MiniSeq Instrument
Local Run Manager (LRM)
In Vitro Diagnostic NextSeq 550Dx
In Vitro Diagnostic MiSeq Dx
NextSeq 500 Instrument
NextSeq 550 Instrument
MiSeq Instrument
iSeq 100 Instrument
MiniSeq Instrument
Local Run Manager (LRM)
Detailed vulnerability description
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and upload outside the intended directory structure.
How to mitigate CVE-2022-1518
Install updates from vendor's website.