Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the extarctZippedFile [sic] method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22504.
Metrics
Affected Vendors & Products
References
History
Fri, 03 Jan 2025 20:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
CPEs | cpe:2.3:a:alltena:allegra:*:*:*:*:*:*:*:* | |
Metrics |
cvssV3_1
|
Mon, 25 Nov 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Alltena
Alltena allegra |
|
CPEs | cpe:2.3:a:alltena:allegra:7.5.0build29:*:*:*:*:*:*:* | |
Vendors & Products |
Alltena
Alltena allegra |
|
Metrics |
ssvc
|
Fri, 22 Nov 2024 20:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the extarctZippedFile [sic] method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22504. | |
Title | Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability | |
Weaknesses | CWE-22 | |
References |
| |
Metrics |
cvssV3_0
|

Status: PUBLISHED
Assigner: zdi
Published: 2024-11-22T20:05:02.383Z
Updated: 2024-11-25T16:41:19.849Z
Reserved: 2023-12-20T21:52:34.963Z
Link: CVE-2023-51640

Updated: 2024-11-25T16:36:09.511Z

Status : Analyzed
Published: 2024-11-22T20:15:06.523
Modified: 2025-01-03T20:21:13.907
Link: CVE-2023-51640

No data.