CVE-2022-38340

概要

参考情報

• community.safe.com/s/article/Known-Issue-Arbitrary-file-upload-with-any-authenticated-FME-Server-account · Third Party Advisory
• community.safe.com/s/article/Known-Issue-FME-Server-vulnerability-with-arbitrary-path-traversal-and-file-upload · Patch
• cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure · Product

fme server のその他の脆弱性

• CVE-2023-35801高 8.1A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a netwo…
• CVE-2022-38339中 6.1Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to exec…
• CVE-2022-38341高 7.1Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
• CVE-2022-38342中 6.5Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows a…
• CVE-2020-22790中 5.4Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web sc…