Description (CNA)
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| LuxSoft / The LuxCal Web Calendar | affected prior to 5.3.3M (MySQL version) |
| LuxSoft / The LuxCal Web Calendar | affected prior to 5.3.3L (SQLite version) |
CWE
CWE-306
References
- https://www.luxsoft.eu/?download
- https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984
- https://jvn.jp/en/jp/JVN26024080/
ADP enrichment
No English description supplied.
No references supplied.