Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via     URI-encoded path separators. (CVE-2021-33896)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via
    URI-encoded path separators. (CVE-2021-33896)

Dino team reports :

It was discovered that when a user receives and downloads a file in Dino, URI-encoded path separators in the file name will be decoded, allowing an attacker to traverse directories and create arbitrary files in the context of the user.

ID	Name	Product	Family	Type	Severity
257362	Linux Distros Unpatched Vulnerability : CVE-2021-33896	Nessus	Misc.	Local	medium
404066	Alpine: multiple dino packages: security update to 0.2.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
404066	Alpine: multiple dino packages: security update to 0.2.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
150408	FreeBSD : dino -- Path traversal in Dino file transfers (fc1bcbca-c88b-11eb-9120-f02f74d0e4bd)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2021-33896

medium

Tenable Plugins

medium

medium

medium

medium