Description
CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CHANGING | Mobile One Time Password | earlier – ≤ 3.11.2 | — |
References
- https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html third-party-advisory