CVEvulnerability
CVE-2015-6459
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-09-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-22
Description
Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.
Affected configurations
• ge mds pulsenet (<= 3.1.3)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9 Vendor Advisory
- http://zerodayinitiative.com/advisories/ZDI-15-439/ zerodayinitiative.com
- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03 Third Party Advisory, US Government Resource
- http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9 Vendor Advisory
- http://zerodayinitiative.com/advisories/ZDI-15-439/ zerodayinitiative.com
- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03 Third Party Advisory, US Government Resource