CVE-2014-0358

High

Published: 15/04/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

Multiple directory traversal vulnerabilities in Xangati XSR before version 11 and XNR before version 7 allow remote attackers to read arbitrary files by exploiting .. (dot dot) sequences in various action parameters.

Risk Assessment

Attackers may gain access to sensitive data on the server, potentially leading to information disclosure and security breaches.

Recommendation

It is recommended to update Xangati XSR to version 11 or newer and XNR to version 7 or newer to mitigate these vulnerabilities.

Other vulnerabilities in Xangati XSR, XNR

CVE-2014-0359High
Xangati XSR before version 11 and XNR before version 7 allows remote attackers to execute arbitrary commands via shell metacharacters in the gui_input_test.pl params parameter to servlet/Installer.

Original NVD description (English source)

Multiple directory traversal vulnerabilities in Xangati XSR before 11 and XNR before 7 allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the file parameter in a getUpgradeStatus action to servlet/MGConfigData, (2) the download parameter in a download action to servlet/MGConfigData, (3) the download parameter in a port_svc action to servlet/MGConfigData, (4) the file parameter in a getfile action to servlet/Installer, or (5) the binfile parameter to servlet/MGConfigData.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS