CVE-2016-5664

CVE-2016-5664 affects Accellion Kiteworks appliances prior to kw2016.03.00. The vulnerability is a directory traversal flaw that allows an unauthenticated remote attacker to read files outside the webroot via a crafted URI. Public sources (NVD) assign a network-based, low- to moderate-severity im...

Accellion Kiteworks contains multiple vulnerabilities

Overview The Accellion Kiteworks appliance prior to version kw2016.03.00 contains multiple vulnerabilities. Description CWE-276: Incorrect Default Permissions - CVE-2016-5662 The /opt/bin/cli script has setuid permissions by default, allowing an authenticated KiteWorks users to escalate privilege...