Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= URI. Validation is performed to ensure that the text passed to the 'file' parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional 'dot dot' style attack.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Sitecore Sitecore.NET Log Viewer应用程序路径遍历漏洞
Vulnerability Description
Sitecore Sitecore.NET是丹麦Sitecore公司的一套基于.NET的网站内容管理系统。Log Viewer application是其中的一个日志查看应用程序。 Sitecore Sitecore.NET 8.1及之前版本中的Log Viewer应用程序存在目录遍历漏洞。攻击者可借助sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= URI利用该漏洞访问任意文件。
CVSS Information
N/A
Vulnerability Type
N/A