CVE-2022-27248

A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files from a remote server…

published April 3, 2022

CVSS
—
EPSS
3%
Percentile
86.7
In the wild
Unconfirmed
What it is

A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files from a remote server by specifying an absolute or relative path when invoking the affected DownloadDwg endpoint. An attack uses the path field to CaddemServiceJS/CaddemService.svc/rest/DownloadDwg.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02867 · 86.7th percentile
Published
2022-04-03T22:14Z
EPSS history
Timeline
  • 03 APR 22:14Z
    A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files from a remote server…
    cvelistv5