CVE-2021-48017 OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the stylename parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/?op=theme with ../ sequences in stylename to read local files such as /etc/passwd...

CVE-2021-48017

OrbiTeam BSCW Server versions 5.x before 5.2.5 and 7.x before 7.4.4 are vulnerable to an unauthenticated path traversal vulnerability. The flaw exists in the style_name parameter of the theme operation. An unauthenticated attacker can submit a GET request to /pub/bscw.cgi/?op=theme using ../ sequ...

Remote code execution

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution RCE via XML tag injection because reportlab\platypus\paraparser.py reached via bscw.cgi op=editfolder.EditFolder calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and...

CVE-2021-36359: XML Injection (aka Blind XPath Injection)

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution RCE via XML tag injection because reportlab\platypus\paraparser.py reached via bscw.cgi op=editfolder.EditFolder calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and...

PT-2021-21250

Name of the Vulnerable Software and Affected Versions OrbiTeam BSCW Classic versions prior to 5.0.12 OrbiTeam BSCW Classic versions prior to 5.1.10 OrbiTeam BSCW Classic versions prior to 5.2.4 OrbiTeam BSCW Classic versions prior to 7.3.3 OrbiTeam BSCW Classic versions prior to 7.4.3 Description...

CVE-2014-2301: Exposure of Sensitive Information to an Unauthorized Actor

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...

PT-2014-4612

Name of the Vulnerable Software and Affected Versions OrbiTeam BSCW versions prior to 5.0.8 Description The issue allows remote attackers to obtain sensitive metadata. This is achieved by performing inf operations op=inf to an object in "pub/bscw.cgi/". Recommendations For versions prior to 5.0.8...