Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...&h= substring followed by a filename.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Butor Portal 路径遍历漏洞
Vulnerability Description
Butor Portal是一套使用在Butor Framework中的Butor门户。 Butor Portal 1.0.27之前版本中存在路径遍历漏洞。攻击者可借助特制URL请求利用该漏洞在系统上下载任意文件。
CVSS Information
N/A
Vulnerability Type
N/A