ZimaOS vulnerable to Directory Listing via Parameter Manipulation
Résumé
ZimaOS vulnerable to Directory Listing via Parameter Manipulation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v2_1/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on the server. By manipulating the path parameter, attackers can access sensitive system directories such as /etc, potentially exposing critical configuration files and increasing the risk of further attacks. As of time of publication, no known patched versions are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web youtu.be