CVEbaza.pl › CWE Dictionary › CWE-57

Common Weakness Enumeration

CWE-57

Path Equivalence: 'fakedir/../realdir/filename'

Category: VariantCVE: 1

Description

The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

CVE vulnerabilities with CWE-57 (1)

4.3

CVSS

MEDIUM

CVE-2024-34995

svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOver. This vulnerability allows attackers to delete arbitrary files via a crafted POST request.

pub. 2024-05-24

Information

ID: CWE-57

Type: Variant

Vulnerabilities: 1

MITRE CWE ↗

← CWE Dictionary