Design/Logic Flaw

2024-02-1503:15:00

PRIOn knowledge base

www.prio-n.com

file download

arbitrary file read

delete vulnerability

request parameters

hgiga oaklouds

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.4%

JSON

The functionality for file download in HGiga OAKlouds’ certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.

References

www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html