medium4.3Public exploit code
CVE-2019-20354
The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the R…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- piSignage 2.6.4 - Directory Traversal2020-01-07 · webapps · hardware · Verified
Impact
The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pisignage | Pisignage | before 2.6.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/155864/piSignage-2.6.4-Directory-Traversal.html
- https://github.com/colloqi/piSignage/blob/master/RELEASE%20NOTES.md
- https://github.com/colloqi/piSignage/issues/97
- http://packetstormsecurity.com/files/155864/piSignage-2.6.4-Directory-Traversal.html
- https://github.com/colloqi/piSignage/blob/master/RELEASE%20NOTES.md
- https://github.com/colloqi/piSignage/issues/97