Description (CNA)
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). NOTE: this issue exists because of an incomplete fix for CVE-2019-17124.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://write-up.github.io/kramerav/
- http://packetstormsecurity.com/files/166623/Kramer-VIAware-Remote-Code-Execution.html
ADP enrichment
No English description supplied.