CVE-2019-15032 — MEDIUM (5.3)

Vulnerability Description

Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Pydio	Pydio	6.0.8

Related Weaknesses (CWE)

CWE-209

References

https://heitorgouvea.me/2019/09/17/CVE-2019-15032ExploitThird Party Advisory
https://pydio.comProduct
https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel/Release Notes
https://heitorgouvea.me/2019/09/17/CVE-2019-15032ExploitThird Party Advisory
https://pydio.comProduct
https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel/Release Notes

FAQ

What is CVE-2019-15032?

CVE-2019-15032 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive informa...

How severe is CVE-2019-15032?

CVE-2019-15032 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-15032?

Check the references section above for vendor advisories and patch information. Affected products include: Pydio Pydio.