CVE-2014-5068 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash) or (2) ..\ (dot dot forward slash) before a file name.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Microsemi	S350I Firmware	2.70.15
Microsemi	S350I	-

Related Weaknesses (CWE)

CWE-22

References

https://www.portcullis-security.com/security-research-and-downloads/security-advThird Party Advisory
https://www.portcullis-security.com/security-research-and-downloads/security-advThird Party Advisory

FAQ

What is CVE-2014-5068?

CVE-2014-5068 is a vulnerability with a CVSS score of 7.5 (HIGH). Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash) or (2) ..\ (dot dot forward slash) b...

How severe is CVE-2014-5068?

CVE-2014-5068 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-5068?

Check the references section above for vendor advisories and patch information. Affected products include: Microsemi S350I Firmware, Microsemi S350I.