CVE-2016-5049
HighSummary
Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.
Risk Assessment
An attacker can gain access to sensitive data on the server, potentially leading to a breach of confidentiality within the organization.
Recommendation
It is recommended to update to the latest version of ReadyDesk and implement security mechanisms to protect against directory traversal attacks.
Other vulnerabilities in ReadyDesk 9.1
See all- CVE-2016-5683High
ReadyDesk 9.1 allows local users to obtain cleartext SQL Server credentials by reading the SQL_Config.aspx file and decrypting data with a hardcoded key in the ReadyDesk.dll file.
- CVE-2016-5050Critical
ReadyDesk 9.1 has an unrestricted file upload vulnerability in chat/sendfile.aspx that allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file.
- CVE-2016-5048Critical
ReadyDesk 9.1 has an SQL injection vulnerability in chat/staff/default.aspx that allows remote attackers to execute arbitrary SQL commands via the user name field.
Original NVD description (English source)
Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.