CVE-2018-15694

HIGH

ASUSTOR Data Master <= 3.1.5 - Authenticated Path Traversal and Arbitrary File Write

Title source: llm

Description

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnerability. This could lead to code execution if the "Web Server" feature is enabled.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://www.tenable.com/security/research/tra-2018-22

Scores

CVSS v3 7.5

EPSS 0.0151

EPSS Percentile 71.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-22

Status published

Products (1)

asustor/data_master < 3.1.5

Published Aug 27, 2018

Tracked Since Feb 18, 2026