CVE-2022-25216

🗓️ 11 Mar 2022 17:54:38Reported by tenableType

cve🔗 web.nvd.nist.gov👁 88 Views🌐 WEB

Absolute path traversal vulnerability in DVDFab 12 Player (PlayerFab), allows remote attackers to download any file on Windows file system via HTTP GET request

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2022-25216	11 Mar 202218:15	–	attackerkb
Circl	CVE-2022-25216	11 Mar 202220:15	–	circl
CNNVD	DVDFab 路径遍历漏洞	11 Mar 202200:00	–	cnnvd
Cvelist	CVE-2022-25216	11 Mar 202217:54	–	cvelist
Nuclei	DVDFab 12 Player/PlayerFab - Local File Inclusion	7 Jun 202603:02	–	nuclei
NVD	CVE-2022-25216	11 Mar 202218:15	–	nvd
Prion	Path traversal	11 Mar 202218:15	–	prion
RedhatCVE	CVE-2022-25216	23 May 202500:04	–	redhatcve

NVD

Node

dvdfab 12_playerRange6.2.10–6.2.11

dvdfab playerfabRange7.0.0.0–7.0.0.5

[
  {
    "product": "DVDFab 12 Player / PlayerFab",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.2.1.0 - 7.0.0.5"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2022-07

Parameter	Position	Path	Description	CWE
<URL_ENCODED_PATH>	path	download/<URL_ENCODED_PATH>	Absolute path traversal via /download/<URL_ENCODED_PATH> allows reading arbitrary files on Windows filesystem based on the user account permissions.	CWE-22

21 Nov 2024 06:51Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.5

CVSS 27.8

EPSS0.76708

CWE-22