未評価
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker...
CVE-2021-29246
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory.
参照URL
- advisory blog.btcpayserver.org
- advisory github.com