Description
A vulnerability was found in Dibo Data Decision Making System up to 2.7.0. The affected element is the function downloadImpTemplet of the file /common/dep/common_dep.action.jsp. The manipulation of the argument filePath results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dibo | Data Decision Making System | 2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7.0 | — |
References
- VDB-325981 | Dibo Data Decision Making System common_dep.action.jsp downloadImpTemplet path traversal vdb-entry technical-description
- VDB-325981 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #658242 | Shenzhen Dibo Enterprise Risk Management Technology Co., Ltd Dibo Data Decision-Making System 2.7.0 arbitrary file read vulnerability third-party-advisory
- https://github.com/FightingLzn9/vul/blob/main/%E8%BF%AA%E5%8D%9A%E6%95%B0%E6%8D%AE%E5%86%B3%E7%AD%96%E7%B3%BB%E7%BB%9F.md exploit