Path Traversal Vulnerability in GrandNode by GrandNode
CVE-2019-12276

7.5HIGH

Key Information:

Vendor

Grandnode

Status
Grandnode
Vendor
CVE Published:
5 June 2019

What is CVE-2019-12276?

A Path Traversal vulnerability exists in the LetsEncryptController component of GrandNode 4.40, which permits remote, unauthenticated attackers to exploit this flaw by crafting specific HTTP requests. By manipulating the LetsEncrypt/Index?fileName= parameter, attackers can gain unauthorized access to sensitive files stored on the web server, potentially exposing critical information. The vulnerability was addressed with a patch released on May 30, 2019. Users of affected versions are strongly advised to upgrade to mitigate this security risk.

References

https://grandnode.com
x_refsource_MISC
https://github.com/grandnode/grandnode
x_refsource_MISC
http://packetstormsecurity.com/files/153373/GrandNode-4.4...
x_refsource_MISC

EPSS Score

57% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.