Description (CNA)
TG8 Firewall exposes a directory such as /data/ over HTTP without authentication. This directory stores credential files for previously logged-in users. A remote unauthenticated attacker can enumerate and download files within the directory to obtain valid account usernames and passwords, leading to loss of confidentiality and further unauthorized access.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TG8 / TG8 Firewall | affected 0 |
CWE
CWE-538
References
- https://ssd-disclosure.com/ssd-advisory-tg8-firewall-preauth-rce-and-password-disclosure/
- https://web.archive.org/web/20211024224240/http://www.tg8security.com/
- https://www.vulncheck.com/advisories/tg8-firewall-unauthenticated-user-password-disclosure
ADP enrichment
No English description supplied.