CVE-2015-8357

CVE-2015-8357 affects the Bitrix bitrix.xscan module prior to v1.0.4. A path traversal in the file parameter fed to /bitrix/admin/bitrix.xscan_worker.php allows an authenticated remote user to rename arbitrary files and disclose contents (via ../ path tricks). The vulnerability is triggered by un...