CVE-2017-6527
HighSummary
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user.
Risk Assessment
An attacker may gain access to sensitive system files, potentially leading to data exposure or further attacks on the system.
Recommendation
It is recommended to update dnaLIMS to the latest version and implement appropriate security measures to mitigate the risk of directory traversal attacks.
Other vulnerabilities in dnaTools dnaLIMS 4-2015s13
See all- CVE-2017-6529High
An issue was discovered in dnaTools dnaLIMS version 4-2015s13 related to session hijacking by guessing the UID parameter.
- CVE-2017-6528High
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to plaintext password storage. The /home/dna/spool/.pfile file contains passwords in plain text.
- CVE-2017-6526Critical
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi in POST requests).
Original NVD description (English source)
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).