Vulnerability Description
Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by manipulating the file parameter. Attackers can send GET requests to modules/backup/actions.php with op=getfile and traverse directories using ../ sequences to access sensitive system files.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- http://www.openstamanager.com/
- https://sourceforge.net/projects/openstamanager/files/latest/download
- https://www.exploit-db.com/exploits/45693
- https://www.vulncheck.com/advisories/open-sta-manager-arbitrary-file-download-vi
FAQ
What is CVE-2018-25421?
CVE-2018-25421 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by manipulating the file parameter. Attackers can send GET requests to modules/...
How severe is CVE-2018-25421?
CVE-2018-25421 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-25421?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.