CVE-2022-24387
File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
| CVE | CVE-2022-24387 | |||||||||||
| Title | File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010 | |||||||||||
| Case | DIVD-2021-00029 | |||||||||||
| Credits |
|
|||||||||||
| Affected products |
|
|||||||||||
| CVSS | ||||||||||||
| References |
|
|||||||||||
| Problem type(s) | CWE-434 Unrestricted Upload of File with Dangerous Type | |||||||||||
| Date published | ||||||||||||
| Last modified | 20 Jun 2024 12:59 UTC |
Description
With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010
JSON version.