CVE-2018-20437

🗓️ 25 Dec 2018 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

Issue in fileDownload function in FEBS-Shiro before 2018-11-05, allowing unauthorized file download

Reporter	Title	Published	Views	Family All 6
CNVD	Unspecified Vulnerability in FEBS-Shiro	27 Dec 201800:00	–	cnvd
Cvelist	CVE-2018-20437	25 Dec 201815:00	–	cvelist
NVD	CVE-2018-20437	25 Dec 201815:29	–	nvd
Prion	Design/Logic Flaw	25 Dec 201815:29	–	prion
Positive Technologies	PT-2018-15376 · Febs · Febs-Shiro	25 Dec 201800:00	–	ptsecurity
Vulnrichment	CVE-2018-20437	25 Dec 201815:00	–	vulnrichment

NVD

Node

mrbird febs-shiroRange<2018.11.05

Source	Link
github	www.github.com/wuyouzhuguli/FEBS-Shiro/issues/40
github	www.github.com/wuyouzhuguli/FEBS-Shiro/commit/a9706b1b3c96bacece24886429b4423c3a467acd
github	www.github.com/wuyouzhuguli/FEBS-Shiro/commit/9a753215b0969a5d5b5bfe8c68585339fee96260

Parameter	Position	Path	Description	CWE
filename	query param	/common/download	Unvalidated direct file download via filename parameter leading to arbitrary file access	CWE-22
delete	query param	/common/download	Unvalidated direct file download via filename parameter leading to arbitrary file access	CWE-22

21 Nov 2024 04:01Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 37.5

CVSS 3.17.5

EPSS0.00502

SSVC