Description
openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OS4ED | openSIS-Classic | 9.3 | — |
References
- https://fluidattacks.com/es/advisories/toto third-party-advisory
- https://github.com/OS4ED/openSIS-Classic product