Remote Information Disclosure Vulnerability in Marvell QConvergeConsole

CVE-2020-15641

What is CVE-2020-15641?

A vulnerability in Marvell QConvergeConsole allows remote attackers to exploit the getFileUploadBytes method within the FlashValidatorServiceImpl class. This security flaw arises from insufficient validation of user-supplied paths, which can lead to the disclosure of sensitive data, including stored credentials, without requiring any authentication. Attackers can leverage this exposure to compromise systems further. For detailed advisories, refer to the official Marvell and ZDI documents.

References