Description (CNA)
ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to access arbitrary files on the server, leading to information disclosure of sensitive system files.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ZwickRoell GmbH & Co. KG / Test Data Management | affected 0 before 3.0.8 |
CWE
CWE-22
References
- https://www.zwickroell.com/accessories/testxpert-testing-software/test-data-management/
- https://www.vulncheck.com/advisories/zwickroell-test-data-management-path-traversal-lfi
ADP enrichment
No English description supplied.
No references supplied.