high7.5
CVE-2019-10257
Zucchetti HR Portal through 2019-03-15 allows Directory Traversal.
Impact
Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java sources from /WEB-INF/classes/*.class
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zucchetti | Hr Portal | through 2019-03-15 |