The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-11-22T08:34:58

Updated: 2024-08-04T01:37:15.574Z

Reserved: 2021-08-05T00:00:00

Link: CVE-2021-38146

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-11-22T09:15:07.347

Modified: 2024-11-21T06:16:28.900

Link: CVE-2021-38146

cve-icon Redhat

No data.