The vulnerability of the FileUploadController servlet in the web application, which is designed for managing and monitoring printing devices and image processing. SyncThru 6 allows a perpetrator to execute arbitrary code with system privileges.

🗓️ 18 Aug 2017 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

FileUploadController SyncThru 6 allows code execution with system privileges via crafted GET request.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the DriverFileUploadServlet server servlet in the web application, which is designed for managing and monitoring printing devices and image processing, allows a perpetrator to delete any file.	18 Aug 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FileUploadController servlet in the web application, which is designed for managing and monitoring printing devices and image processing. SyncThru 6 allows a perpetrator to execute arbitrary code with system privileges.	18 Aug 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FileUploadController servlet in the web application, which is designed for managing and monitoring printing devices and image processing. SyncThru 6 allows a perpetrator to execute arbitrary code with system privileges.	18 Aug 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the DriverFileUploadServlet server servlet in the web application, which is designed for managing and monitoring printing devices and image processing, allows a perpetrator to execute arbitrary code in the context of the current user.	18 Aug 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AddDriverFileServlet servlet in the web application, which is designed for managing and monitoring printing devices and image processing, allows a perpetrator to delete any file.	18 Aug 201700:00	–	bdu_fstec
CNVD	Samsung SyncThru Directory Traversal Vulnerability	22 Jul 201500:00	–	cnvd
CVE	CVE-2015-5473	1 Jun 201716:00	–	cve
Cvelist	CVE-2015-5473	1 Jun 201716:00	–	cvelist
NVD	CVE-2015-5473	1 Jun 201716:29	–	nvd
Prion	Directory traversal	1 Jun 201716:29	–	prion

Source	Link
securityfocus	www.securityfocus.com/bid/75912
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-15-297
web	www.web.nvd.nist.gov/view/vuln/detail
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-15-297/

23 Mar 2021 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 210

EPSS0.46933

file upload controller syncthru six code execution system privileges crafted get request restricted directory path vulnerability