In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download arbitrary files from the server.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-01-21T15:34:55

Updated: 2024-08-05T00:26:38.780Z

Reserved: 2019-08-07T00:00:00

Link: CVE-2019-14767

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-01-21T16:15:12.637

Modified: 2024-11-21T04:27:18.307

Link: CVE-2019-14767

cve-icon Redhat

No data.