Directory Traversal

ioBroker.js-controller is vulnerable to directory traversal. An attacker is able to include file contents from outside of the /adapter/ directory via the administrative web panel using a request for an adapter file containing the ../ characters in the file name. Authentication is not enabled by...

CVE-2019-10767

An attacker can include file contents from outside the /adapter/xxx/ directory, where xxx is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. Note: The attacker has to be logged in if the authentication is enabled...

CVE-2019-10767

An attacker can include file contents from outside the /adapter/xxx/ directory, where xxx is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. Note: The attacker has to be logged in if the authentication is enabled...

CVE-2019-10767: Improper Limitation of a Pathname to a Restricted Directory

An attacker can include file contents from outside the /adapter/xxx/ directory, where xxx is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. Note: The attacker has to be logged in if the authentication is enabled...

PT-2019-12039

Name of the Vulnerable Software and Affected Versions iobroker.controller versions prior to 2.0.25 Description The issue allows an attacker to include file contents from outside the intended directory using the administrative web panel. This can be exploited by making a request for an adapter fil...