SeamCorrectionFileCreate Path Traversal File Upload. A path traversal vulnerability exists in the endpoint handler for /api/management/seamCorrectionFileCreate in Management. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. Exe&coef= ' '
:8787/api/management/seamCorrectionFileCreate'> get3DLutFile Path Traversal File Upload. A path traversal vulnerability exists in the endpoint handler for /api/Management/get3DLutFile in Management. The file extension of the uploaded file is limited to. A path traversal vulnerability exists in the endpoint handler for /api/management/remove3DLUT in Management. An unauthenticated remote attacker can exploit this to delete any file on the disk drive where the product is installed. ././././././tmp/delete me. As the vendor themselves are the CNA with claims to these products, we are unable to assign identifiers. October 6, 2023 - Tenable discloses issues to vendor. November 21, 2023 - Vendor states issues have been fixed. November 21, 2023 - Tenable requests information regarding advisories/CVEs. November 21, 2023 - Vendor states that CVE identifiers were not assigned. All information within TRA advisories is provided "As is", without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order. For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
This Cyber News was published on www.tenable.com. Publication date: Thu, 30 Nov 2023 21:55:18 +0000