Description
A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives.
References
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-021.txt
ExploitThird Party Advisory
https://www.syss.de/pentest-blog/
Third Party Advisory
CVSS impact metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
6.5 · Medium
CVSS V3.1
CVSS V3.0
CVSS V2.0
Information
Source identifier
Vulnerability status
Analyzed
Published
2021-07-14T14:15:08.847
3 years agoLast modified
2021-07-16T14:14:26.977
3 years ago