Description (CNA)
An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enabled (by default isn't enabled).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / iobroker.js-controller | affected All versions prior to version 2.0.25 |
CWE
No CWE identifiers supplied.
References
- https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fda
- https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881
ADP enrichment
No English description supplied.