Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LORIS vulnerable to path traversal in electrophysiology_browser
Vulnerability Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a path traversal vulnerability. Some of these files contain hard-coded credentials. The vulnerability allows an attacker to read configuration files containing hard-coded credentials. The attacker could then authenticate to the database or other services if those credentials are reused. The attacker must be authenticated and have the required permissions. However, the vulnerability is easy to exploit and the application source code is public. This problem is fixed in LORIS v26.0.5 and v27.0.2 and above, and v28.0.0 and above. As a workaround, the electrophysiogy_browser in LORIS can be disabled by an administrator using the module manager.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
LORIS Neuroimaging Platform 路径遍历漏洞
Vulnerability Description
LORIS Neuroimaging Platform是ACElab开源的一个神经影像平台。 LORIS Neuroimaging Platform 24.0.0版本至26.0.5之前版本、27.0.2之前版本和28.0.0之前版本存在路径遍历漏洞，该漏洞源于路径遍历漏洞，可能导致读取包含硬编码凭据的配置文件。
CVSS Information
N/A
Vulnerability Type
N/A