PT-2023-13728

Name of the Vulnerable Software and Affected Versions Italtel NetMatch-S CI version 5.2.0-20211008 Description The issue allows an unauthenticated user to upload files to an arbitrary path due to Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An attacker can modify the uploadDir...

CVE-2022-39812: Improper Limitation of a Pathname to a Restricted Directory

Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request not possible using the GUI to an arbitrary directory. Because th...

PT-2023-13727

Name of the Vulnerable Software and Affected Versions Italtel NetMatch-S CI version 5.2.0-20211008 Description The issue concerns incorrect Access Control. Specifically, it affects the "NMSCI-WebGui/advancedsettings.jsp" and "NMSCI-WebGui/SaveFileUploader" endpoints. This allows an attacker to vi...