重大
9.8
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer...
CVE-2021-48014
SecPulse初出
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| FanRuan | FineReport | — | — |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- web github.com
- web github.com
- web github.com
- web fanruan.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com