CVE-2020-29134HIGH
Description
The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all versions Fluig Lake 1.7.0, Fluig 1.6.5 and Fluig 1.6.4
References
https://github.com/lucxssouza/CVE-2020-29134
https://github.com/lucxssouza/CVE-2020-29134/blob/main/README.md
Details
Source: MITRE
Published: 2021-03-05
Updated: 2021-03-27
Type: CWE-22
Risk Information
CVSS v2.0
Base Score: 7.8
Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Impact Score: 6.9
Exploitability Score: 10
Severity: HIGH
CVSS v3.0
Base Score: 8.6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Impact Score: 4
Exploitability Score: 3.9
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:totvs:fluig:1.6.4:*:*:*:*:*:*:*