CVE-2019-20354

Katalog CVE

CVSS 4.3 · Medium EPSS 8,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada pisignage. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download.

Rincian

Terbit di NVD

6 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

8,8% peluang dieksploitasi; lebih tinggi dari 95,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/155864/piSignage-2.6.4-Directory-Traversal.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/colloqi/piSignage/issues/97 exploit · advisory pihak ketiga
• https://github.com/colloqi/piSignage/blob/master/RELEASE%20NOTES.md release notes