In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HProgress Sharefile Storage Zones Controller
APPProgress< 5.12.66.0 – 6.0.3 (excl.)
Related vulnerabilities
Auth Bypass i RCE w Progress ShareFile Storage Zones Controller
RCE w Progress Sharefile Storage Zones Controller — upload złośliwego pliku
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perf...
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted...
Path traversal w Progress ShareFile Storage Zones Controller