CVE-2018-20437
High
Description
An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of this report because the product uses a JAR archive for deployment, and this contains application.yml with configuration data
SeverityHigh
CVSS7.5
Exploit probability—
ProductMrbird Febs-shiro
PublishedDec 25, 2018
First seenDec 25, 2018
How to fix
Update
- mrbird febs-shiro2018.11.05 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mrbird febs-shiro | v < 2018.11.05 | 2018.11.05 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.