CVE-2018-14573
Medium
Description
A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683.
SeverityMedium
CVSS5.5
Exploit probability—
ProductTrms Tightrope Media Carousel Digital Signage
PublishedJul 23, 2018
First seenJul 23, 2018
How to fix
Update
- trms tightrope_media_carousel_digital_signage7.3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trms tightrope_media_carousel_digital_signage | v < 7.3.5 | 7.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.