CVE-2021-41714 Information

Description

In Tipask < 3.5.9 path parameters entered by the user are not validated when downloading attachments a registered user can download arbitrary files on the Tipask server such as .env /etc/passwd laravel.log causing infomation leakage.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Reference

https://github.com/sdfsky/tipask/commit/9b5f13d1708e9a5dc0959cb8a97be1c32b94ca69 https://github.com/sdfsky/tipask/blob/c4e6aa9f6017c9664780570016954c0922d203b7/app/Http/Controllers/AttachController.php#L42 https://www.yuque.com/henry-weply/penetration/fza5hm

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

6.5