Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the downloadExportedChart action. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22361.
Metrics
Affected Vendors & Products
References
History
Fri, 03 Jan 2025 20:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
CPEs | cpe:2.3:a:alltena:allegra:*:*:*:*:*:*:*:* | |
Metrics |
cvssV3_1
|
Mon, 25 Nov 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Alltena
Alltena allegra |
|
CPEs | cpe:2.3:a:alltena:allegra:7.5.0build29:*:*:*:*:*:*:* | |
Vendors & Products |
Alltena
Alltena allegra |
|
Metrics |
ssvc
|
Fri, 22 Nov 2024 20:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadExportedChart action. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22361. | |
Title | Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability | |
Weaknesses | CWE-22 | |
References |
| |
Metrics |
cvssV3_0
|

Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2024-11-25T16:41:26.650Z
Reserved: 2023-12-20T21:52:34.963Z
Link: CVE-2023-51639

Updated: 2024-11-25T16:36:10.844Z

Status : Analyzed
Published: 2024-11-22T20:15:06.400
Modified: 2025-01-03T20:19:50.817
Link: CVE-2023-51639

No data.