Path Traversal Vulnerability in ASUSTOR Data Master by ASUSTOR
CVE-2018-15694

7.5HIGH

Key Information:

Vendor

Tenable

Status
Asustor Data Master
Vendor
CVE Published:
27 August 2018

What is CVE-2018-15694?

ASUSTOR Data Master versions 3.1.5 and earlier are susceptible to a path traversal vulnerability that permits authenticated remote non-administrative users to upload files to arbitrary directories. This vulnerability, if exploited, could allow for code execution, particularly when the 'Web Server' feature is enabled. It is crucial for users of ASUSTOR devices to ensure they are using the latest version to mitigate potential security risks.

Affected Version(s)

ASUSTOR Data Master 3.1.5 and below

References

https://www.tenable.com/security/research/tra-2018-22
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.