CVE-2019-10767

An attacker can include file contents from outside the /adapter/xxx/ directory, where xxx is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. Note: The attacker has to be logged in if the authentication is enabled...

CVE-2019-10767

CVE-2019-10767 affects iobroker.js-controller (Linux/Windows environments) where a path traversal flaw allows inclusion of files outside the /adapter/xxx/ directory when using the administrative web panel to request an adapter file. The root cause is inadequate access restriction outside the inte...