ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in wallpaper.cgi.

According to its self-reported version number, the ASUSTOR Data Master (ADM) web interface running on the remote web server is prior to 3.1.6. It is, therefore, affected by multiple vulnerabilities:

  - CVE-2018-15694: Authenticated File Upload

  - CVE-2018-15695: Authenticated Arbitrary File Deletion

  - CVE-2018-15696: Authenticated Account Enumeration

  - CVE-2018-15697: Authenticated File Disclosure

  - CVE-2018-15698: Authenticated File Disclosure

  - CVE-2018-15699: MITM XSS

Detections

Analytics

CVE-2018-15695

medium

Tenable Plugins

high