medium6.4
CVE-2015-4670
Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers…
Impact
Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Devexpress | Ajax Control Toolkit | through 15.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.cardinaleconcepts.com/cve-2015-4670-directory-traversal-to-remote-code-execution-in-ajaxcontroltoolkit/
- http://www.securityfocus.com/archive/1/535990/100/0/threaded
- http://www.cardinaleconcepts.com/cve-2015-4670-directory-traversal-to-remote-code-execution-in-ajaxcontroltoolkit/
- http://www.securityfocus.com/archive/1/535990/100/0/threaded