Description
A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the function multiselect_filtering of the file eNMS/controller.py of the component TGZ File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 22b0b443acca740fc83b5544165c1f53eff3f529. It is recommended to apply a patch to fix this issue.
References (8)
Core 8
Core References
Third Party Advisory vdb-entry
technical-description
https://vuldb.com/?id.285986
Permissions Required signature
permissions-required
https://vuldb.com/?ctiid.285986
Third Party Advisory third-party-advisory
https://vuldb.com/?submit.447374
Exploit, Third Party Advisory issue-tracking
https://github.com/eNMS-automation/eNMS/pull/419
Exploit, Third Party Advisory issue-tracking
https://github.com/eNMS-automation/eNMS/pull/419#issuecomment-2495640750
Exploit exploit
https://mega.nz/folder/ZhIiDQaI#TUJCRV-XN41L-WEVAu0sWg
Patch issue-tracking
patch
https://github.com/eNMS-automation/eNMS/pull/419/commits/22b0b443acca740fc83b5544165c1f53eff3f529
Exploit media-coverage
https://www.youtube.com/watch?v=FJVFtNb4_qA
Scores
CVSS v3
8.8
EPSS
0.0194
EPSS Percentile
77.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-22
Status
published
Products (1)
enms/enms
< 4.2
Published
Nov 25, 2024
Tracked Since
Feb 18, 2026