CVE-2023-34394
19.07.2023, 22:15
In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial-of-service condition.Enginsight
| Vendor | Product | Version |
|---|---|---|
| keysight | geolocation_server | 𝑥 ≤ 2.4.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-23 - Relative Path TraversalThe software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
- CWE-434 - Unrestricted Upload of File with Dangerous TypeThe software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.