NCH WebDictate 路径遍历漏洞

A security vulnerability exists in NCH WebDictate, a web-based dictation recording, editing and management software, which stems from the product's logprop?file=/... path fails to filter incoming special characters, which can be exploited to read critical files...

CVE-2021-37445: Improper Limitation of a Pathname to a Restricted Directory

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading...

CVE-2021-37440: Improper Limitation of a Pathname to a Restricted Directory

NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring...

CVE-2021-37469: Improper Limitation of a Pathname to a Restricted Directory

In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem...