Description
Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Endian | Endian Firewall | ≤ 3.3.25 | — |
References
- Endian Release Notes release-notes
- VulnCheck Advisory: Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal third-party-advisory