high7.5
CVE-2020-35736
GateOne 1.1 allows arbitrary file download without authentication via /downloads/..
Impact
GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liftoffsoftware | Gateone | Version 1.1 |