EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to `body.tpl` or `subject.tpl` under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

相对路径遍历

EspoCRM 安全漏洞

EspoCRM是EspoCRM开源的一套开源的基于Web的客户关系管理系统（CRM）。该系统提供销售自动化、社区和客户支持等功能。 EspoCRM 9.3.4之前版本存在安全漏洞，该漏洞源于管理员模板管理端点接受攻击者控制的name和scope值，并在未进行规范化或遍历过滤的情况下将其传递到模板路径构造中。因此，经过身份验证的管理员可以使用../序列逃离预期的模板目录，并根据Web应用程序用户的文件系统权限读取、创建、覆盖或删除解析为body.tpl或subject.tpl的任意文件。

N/A

N/A