{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-25098","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2023-01-05T07:56:16.838Z","datePublished":"2023-01-05T07:59:57.377Z","dateUpdated":"2024-08-05T03:00:19.237Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2023-10-20T12:51:57.618Z"},"title":"soerennb eXtplorer Archive archive.php path traversal","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-22","lang":"en","description":"CWE-22 Path Traversal"}]}],"affected":[{"vendor":"soerennb","product":"eXtplorer","versions":[{"version":"2.1.0","status":"affected"},{"version":"2.1.1","status":"affected"},{"version":"2.1.2","status":"affected"},{"version":"2.1.3","status":"affected"},{"version":"2.1.4","status":"affected"},{"version":"2.1.5","status":"affected"},{"version":"2.1.6","status":"affected"},{"version":"2.1.7","status":"affected"},{"version":"2.1.8","status":"affected"},{"version":"2.1.9","status":"affected"},{"version":"2.1.10","status":"affected"},{"version":"2.1.11","status":"affected"},{"version":"2.1.12","status":"affected"}],"modules":["Archive Handler"]}],"descriptions":[{"lang":"en","value":"A vulnerability was found in soerennb eXtplorer up to 2.1.12. It has been classified as critical. This affects an unknown part of the file include/archive.php of the component Archive Handler. The manipulation leads to path traversal. Upgrading to version 2.1.13 is able to address this issue. The identifier of the patch is b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The identifier VDB-217437 was assigned to this vulnerability."},{"lang":"de","value":"Es wurde eine Schwachstelle in soerennb eXtplorer bis 2.1.12 ausgemacht. Sie wurde als kritisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei include/archive.php der Komponente Archive Handler. Dank der Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 2.1.13 vermag dieses Problem zu lösen. Der Patch wird als b8fcb888f4ff5e171c16797a4b075c6c6f50bf46 bezeichnet. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen."}],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":5.5,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.5,"vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.2,"vectorString":"AV:A/AC:L/Au:S/C:P/I:P/A:P"}}],"timeline":[{"time":"2023-01-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2023-01-05T00:00:00.000Z","lang":"en","value":"CVE reserved"},{"time":"2023-01-05T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2023-01-28T14:16:10.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"VulDB GitHub Commit Analyzer","type":"tool"}],"references":[{"url":"https://vuldb.com/?id.217437","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.217437","tags":["signature","permissions-required"]},{"url":"https://github.com/soerennb/extplorer/commit/b8fcb888f4ff5e171c16797a4b075c6c6f50bf46","tags":["patch"]},{"url":"https://github.com/soerennb/extplorer/releases/tag/v2.1.13","tags":["patch"]}]},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:00:19.237Z"},"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.217437","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.217437","tags":["signature","permissions-required","x_transferred"]},{"url":"https://github.com/soerennb/extplorer/commit/b8fcb888f4ff5e171c16797a4b075c6c6f50bf46","tags":["patch","x_transferred"]},{"url":"https://github.com/soerennb/extplorer/releases/tag/v2.1.13","tags":["patch","x_transferred"]}]}]}}