Stimulsoft Dashboard.JS directory traversal vulnerability

Description

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

Recommendation

Update the stimulsoft-dashboards-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2024.1.3
• Patched version(s): 2024.1.3

References

• GHSA-gfqf-9w98-7jmx
• cloud-trustit.spp.at
• stimulsoft.com
• cves.at
• CVE-2024-24398
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability (GHSA-9cgf-pxwq-2cpw) - CVE-2024-24397
• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - CVE-2024-24396
• Langchain Path Traversal vulnerability - CVE-2024-7774
• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818

Tags:

npm

stimulsoft-dashboards-js