Vulnerability Details CVE-2013-4861
Directory traversal vulnerability in cgi-bin/cmh/get_file.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users to read arbirary files via a .. (dot dot) in the filename parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.146
EPSS Ranking 94.1%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
- http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.html
- http://www.exploit-db.com/exploits/27286
- https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txt
- http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.html
- http://www.exploit-db.com/exploits/27286
- https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txt
Products affected by CVE-2013-4861
-
cpe:2.3:h:micasaverde:veralite:-
-
cpe:2.3:o:micasaverde:veralite_firmware:1.5.408