HIGH🇬🇧 English

CVE-2020-16136

CVSS 7.7v3.1pub. 2020-07-31upd. 2024-11-21

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owner of the server process) via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files, however.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

  • Tgstation13 Tgstation Server

    APP
    Tgstation13
    4.4.04.4.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
CWE
Referencje

Powiązane podatności

CVE-2018-17107CRITICAL9.8PL ✓ten sam produkt

Tgstation-Server: pominięcie uwierzytelnienia przez cache aktywnych sesji

CVE-2025-21611HIGH8.8ten sam produkt

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to author...

CVE-2024-41799HIGH8.4ten sam produkt

tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users ...

CVE-2023-32687HIGH7.7ten sam produkt

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12....

CVE-2023-34243MEDIUM5.8ten sam produkt

TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was register...