|
[Japanese]
|
JVNDB-2020-000082
|
FileZen vulnerable to directory traversal
|
|
FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface.
FileZen contains a directory traversal vulnerability (CWE-22).
Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Soliton Systems K.K. coordinated under the Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 7.5 (High) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 5.0 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
Soliton Systems K.K.
- FileZen versions from V3.0.0 to V4.2.2
|
|
|
A remote attacker may upload an arbitrary file in the specific directory in the product.
If a specialy crafted file is uploaded by an attacker, it may lead to an arbitrary OS command execution.
|
|
[Update the software]
Update the software to the latest version according to the information provided by the developer.
According to the developer, this vulnerability has been already addressed in V4.2.3 released on January 30, 2019.
In addition, the possible arbitrary OS command execution issue has been addressed in the following versions.
* V4.2.6 (Released on December 7, 2020)
* V5.0.1 (Released on December 9, 2020)
|
|
Soliton Systems K.K.
|
|
- Path Traversal(CWE-22) [IPA Evaluation]
|
|
- CVE-2020-5639
|
|
- JVN : JVN#12884935
- National Vulnerability Database (NVD) : CVE-2020-5639
- JPCERT : Alert Regarding File Data Transfer Appliance FileZen
|
|
- [2020/12/10]
Web page was published
|
