JVN#22670349: AndExplorer vulnerable to directory traversal

AndExplorer provided by LYSESOFT contains an issue in processing file names, which may result in a directory traversal (CWE-22) vulnerability.

Impact

A remote, unauthenticated attacker may create an arbitrary file or overwrite an existing file in a directory that the application has privileges to access.

Solution

Update the software
Update the software if you are using a version of AndExplorer that was downloaded prior to April 3, 2014 or using a version of AndExplorerPro that was downloaded prior to April 5, 2014.

The software version that is downloaded will differ depending on the version of Android OS that you are using.

Products Affected

• AndExplorer versions released prior to April 3, 2014
• AndExplorerPro versions released prior to April 5, 2014