CVE-2014-2232

Absolute path traversal vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to read arbitrary files via unspecified vectors.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://iw.mapandroute.de/MapAPI-1.1/releaseHistory.jsp	Vendor Advisory
http://www.christian-schneider.net/advisories/CVE-2014-2232.txt	Third Party Advisory
http://iw.mapandroute.de/MapAPI-1.0/releaseHistory.jsp	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:infoware:mapsuite::::::::
	cpe:2.3:a:infoware:mapsuite::::::::

Information

Published : 2014-12-01 07:59

Updated : 2018-12-12 09:16

NVD link : CVE-2014-2232

Mitre link : CVE-2014-2232

JSON object : View

CWE

CWE-21

DEPRECATED: Pathname Traversal and Equivalence Errors

Products Affected

infoware

mapsuite

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://iw.mapandroute.de/MapAPI-1.1/releaseHistory.jsp", "name": "http://iw.mapandroute.de/MapAPI-1.1/releaseHistory.jsp", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.christian-schneider.net/advisories/CVE-2014-2232.txt", "name": "http://www.christian-schneider.net/advisories/CVE-2014-2232.txt", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "http://iw.mapandroute.de/MapAPI-1.0/releaseHistory.jsp", "name": "http://iw.mapandroute.de/MapAPI-1.0/releaseHistory.jsp", "tags": ["Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Absolute path traversal vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to read arbitrary files via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-21"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-2232", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-12-01T15:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:infoware:mapsuite:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.1.49", "versionStartIncluding": "1.1"}, {"cpe23Uri": "cpe:2.3:a:infoware:mapsuite:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.0.36", "versionStartIncluding": "1.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-12-12T17:16Z"}

5.0 /10