CVE-2022-51025

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

CVE-2022-51025

Penta Security WAPPLES versions 4.0.54.1, 5.0, and 6.0 are affected by a path traversal vulnerability in the /webapi/file/transfer endpoint. Authenticated attackers can use the name parameter with ../ sequences and type=db_backup to download arbitrary files, such as /etc/passwd . Authentication i...