CVE-2023-6352

Medium

Description

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.

SeverityMedium

CVSS5.3

Exploit probability—

ProductAquaforest Tiff Server

PublishedNov 30, 2023

First seenNov 30, 2023

Weakness typeCWE-22Path traversal

How to fix

Vendor advisories

aquaforest.com/blog/tiff-server-security-update

Affected products

Product	Affected versions	Fixed in
aquaforest tiff_server	4.2.210913	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.