Vulnerability Description
In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Axway | File Tranfer Direct | 2.7.1 |
Related Weaknesses (CWE)
References
- https://github.com/inf0seq/inf0seq.github.io/blob/master/_posts/2019-01-20-DirecExploitThird Party Advisory
- https://inf0seq.github.io/cve/2019/01/20/Directory-Traversal-in-Axway-File-TransExploitThird Party Advisory
- https://github.com/inf0seq/inf0seq.github.io/blob/master/_posts/2019-01-20-DirecExploitThird Party Advisory
- https://inf0seq.github.io/cve/2019/01/20/Directory-Traversal-in-Axway-File-TransExploitThird Party Advisory
FAQ
What is CVE-2019-6500?
CVE-2019-6500 is a vulnerability with a CVSS score of 7.5 (HIGH). In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demons...
How severe is CVE-2019-6500?
CVE-2019-6500 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-6500?
Check the references section above for vendor advisories and patch information. Affected products include: Axway File Tranfer Direct.