Stimulsoft Dashboard.JS directory traversal vulnerability

Description

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

Recommendation

Update the stimulsoft-dashboards-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2024.1.3
• Patched version(s): 2024.1.3

References

• GHSA-gfqf-9w98-7jmx
• cloud-trustit.spp.at
• stimulsoft.com
• cves.at
• CVE-2024-24398
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Finance.js vulnerable to DoS via the seekZero() parameter - CVE-2025-56572
• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability (GHSA-9cgf-pxwq-2cpw) - CVE-2024-24397
• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - CVE-2024-24396
• Inefficient Regular Expression Complexity in handsontable - CVE-2021-23446

Tags:

npm

stimulsoft-dashboards-js