CVE-2017-20105 — MEDIUM (5.4)

Vulnerability Description

A vulnerability was found in Simplessus 3.7.7. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument path with the input ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.8.3 is able to address this issue. It is recommended to upgrade the affected component.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Simplessus	Simplessus	3.7.7

Related Weaknesses (CWE)

CWE-22

References

http://seclists.org/bugtraq/2017/Feb/40ExploitMailing ListThird Party Advisory
https://vuldb.com/?id.97253Third Party Advisory
http://seclists.org/bugtraq/2017/Feb/40ExploitMailing ListThird Party Advisory
https://vuldb.com/?id.97253Third Party Advisory

FAQ

What is CVE-2017-20105?

CVE-2017-20105 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A vulnerability was found in Simplessus 3.7.7. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument path with the input ..%2f..%2f..%2f..%2f..%2f...

How severe is CVE-2017-20105?

CVE-2017-20105 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-20105?

Check the references section above for vendor advisories and patch information. Affected products include: Simplessus Simplessus.