Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2015-4666 — Path Traversal in Xsuite

CWE-22 — Path Traversal5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
16.4%
top 5.12%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Xceedium Xsuite
Timeline
PublishedAug 13
Latest updateMay 14

Description

Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDxceedium/xsuite2.3.0, 2.4.3.0+1

🔴Vulnerability Details

2
GHSA
GHSA-v46w-rfmj-gcqr: Directory traversal vulnerability in opm/read_sessionlog↗2022-05-14
▶
CVEList
CVE-2015-4666: Directory traversal vulnerability in opm/read_sessionlog↗2015-08-13
▶

💥Exploits & PoCs

2
Exploit-DB
Xceedium Xsuite - Multiple Vulnerabilities↗2015-07-27
▶
Nuclei
Xceedium Xsuite <=2.4.4.5 - Local File Inclusion
▶
CVE-2015-4666 — Path Traversal in Xceedium Xsuite | cvebase