High · published March 4, 2025
CVSS calls it high at 8.6. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A crafty absolute path traversal flaw lurks in NAKIVO Backup & Replication before version 11.0.0.88174, allowing attackers to peek behind the curtain and access any file they want! ⚡ Think of it like a delivery driver with the keys to the supply closet, who can wander anywhere they please, rummaging through confidential documents without anyone stopping them. That's exactly what happens here when it comes to file access! This vulnerability could be absolutely devastating, paving the way for remote code execution across the entire enterprise! An attacker could easily exploit this flaw to gain access to sensitive data, change configurations, or even take complete control of the system, leading to serious security breaches.
Think of it like a delivery driver with the keys to the supply closet, who can wander anywhere they please, rummaging through confidential documents without anyone stopping them. That's exactly what happens here when it comes to file access! The flaw arises from insufficient validation in the getImageByPath function, which allows attackers to supply absolute paths that can lead to unauthorized file access, including cleartext credentials stored in the PhysicalDiscovery component.
This vulnerability could be absolutely devastating, paving the way for remote code execution across the entire enterprise! An attacker could easily exploit this flaw to gain access to sensitive data, change configurations, or even take complete control of the system, leading to serious security breaches. Patch your NAKIVO Backup & Replication to version 11.0.0.88174 immediately to close this door! Additionally, review your security configurations to ensure no sensitive information is left exposed and monitor your logs for any suspicious activity. 🛡️ You've got this! Secure your systems and keep the bad guys at bay. 🔒💪
| Product | Versions | Fixed in |
|---|---|---|
| nakivo/backup_\&_replication_director | < 11.0.0.88174 | 11.0.0.88174 |