medium6.5
CVE-2022-39034
Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs.
Impact
Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lcnet | Smart Evision | Version 2022.03.21 |