Vulnerability Details
CWE: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Severity: Medium
A path traversal vulnerability existed in the CloudBeaver resource-management project resolution.
The issue is fixed by validating project names before resolving them against the shared projects path.
Impact
A path traversal vulnerability allowed project path resolution to escape the intended shared project directory. An attacker with resource-management privileges could use crafted project identifiers to enumerate directory names on the server outside the expected project sandbox.
Successful exploitation may disclose information about the server’s filesystem layout, which could help an attacker plan further attacks. Confirmed impact is limited to directory name enumeration; arbitrary file read, file write, or deletion has not been confirmed.
References
iaohkut-from-NightWolf-Team Reporter
Vulnerability Details
CWE: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Severity: Medium
A path traversal vulnerability existed in the CloudBeaver resource-management project resolution.
The issue is fixed by validating project names before resolving them against the shared projects path.
Impact
A path traversal vulnerability allowed project path resolution to escape the intended shared project directory. An attacker with resource-management privileges could use crafted project identifiers to enumerate directory names on the server outside the expected project sandbox.
Successful exploitation may disclose information about the server’s filesystem layout, which could help an attacker plan further attacks. Confirmed impact is limited to directory name enumeration; arbitrary file read, file write, or deletion has not been confirmed.
References