CVE-2020-35284

Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5…

published December 26, 2020

CVSS
—
EPSS
2%
Percentile
76.1
In the wild
Unconfirmed
What it is

Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product's source code is available.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01637 · 76.1th percentile
Published
2020-12-26T05:31Z
EPSS history
Timeline
  • 26 DEC 05:31Z
    Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5…
    cvelistv5