Description (CNA)
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Arcadia Technology, LLC / Crafty Controller | affected 4.4.0 through 4.10.7 |
CWE
CWE-35
References
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/727
- https://gitlab.com/crafty-controller/crafty-4/-/work_items/740
ADP enrichment
No English description supplied.