CVE-2020-15712

2020-07-2813:03:09

mitre

www.cve.org

5.5 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.1%

JSON

rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByPath.php script containing hexadecimal encoded “dot dot” sequences (%2f…%2f) in the path parameter to view arbitrary files on the system.