NetSight
IP …
medium6.5Public exploit code

CVE-2014-2575

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x be…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.

Affected products

VendorProductAffected versions
DevexpressAspxfilemanager Control For Webforms And Mvc
through 13.1.9
Versions 10.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6

Weakness classification

CWE-22

References