Lucene search

MitreCVE-2019-14251

HistoryDec 09, 2019 - 5:15 p.m.

CVE-2019-14251

2019-12-0917:15:11

CWE-22

mitre

web.nvd.nist.gov

cve-2019-14251

t24

temenos channels

security issue

file access

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.019

Percentile

88.7%

JSON

An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer() to traverse the file system and access files or directories that are outside of the restricted directory because WealthT24/GetImage is used with the docDownloadPath and uploadLocation parameters.

Affected configurations

Nvd

Node

temenost24Matchr15.01

VendorProductVersionCPE
temenost24r15.01cpe:2.3:a:temenos:t24:r15.01:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
temenos	t24	r15.01	cpe:2.3:a:temenos:t24:r15.01:::::::*

References

github.com/kmkz/exploit/blob/master/CVE-2019-14251-TEMENOS-T24.txt

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.019

Percentile

88.7%

JSON

Related for CVE-2019-14251