CVE-2023-6352CWE-22

Aquaforest TIFF Server default configuration allows access to arbitrary files

Medium · published November 30, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01104 · 65.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-11-30T18:01Z
EPSS history
Timeline
  • 30 NOV 18:01Z
    Aquaforest TIFF Server default configuration allows access to arbitrary files
    cvelistv5