Vulnerability Description
Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Devexpress | Aspxfilemanager Control For Webforms And Mvc | <= 13.1.9 |
Related Weaknesses (CWE)
References
- http://osvdb.org/show/osvdb/107742
- http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2
- http://seclists.org/fulldisclosure/2014/Jun/24Exploit
- http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2Vendor Advisory
- http://www.exploit-db.com/exploits/33700
- http://www.securityfocus.com/archive/1/532304/100/0/threaded
- http://www.securityfocus.com/bid/67902
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-006/-directory-traverExploit
- http://osvdb.org/show/osvdb/107742
- http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2
- http://seclists.org/fulldisclosure/2014/Jun/24Exploit
- http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2Vendor Advisory
- http://www.exploit-db.com/exploits/33700
- http://www.securityfocus.com/archive/1/532304/100/0/threaded
- http://www.securityfocus.com/bid/67902
FAQ
What is CVE-2014-2575?
CVE-2014-2575 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated u...
How severe is CVE-2014-2575?
CVE-2014-2575 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-2575?
Check the references section above for vendor advisories and patch information. Affected products include: Devexpress Aspxfilemanager Control For Webforms And Mvc.