CVE-2014-2352 (GCVE-0-2014-2352)
Vulnerability from cvelistv5
Published
2014-05-30 23:00
Modified
2025-10-03 16:31
Severity ?
CWE
Summary
The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable an attacker to access a limited number of hardcoded file types. Further exploitation of this vulnerability may allow an attacker to cause the web server component to enter a denial-of-service condition.
References
ics-cert@hq.dhs.govhttp://cogentdatahub.com/Download_Software.html
ics-cert@hq.dhs.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02
af854a3a-2127-422b-91ae-364da2661108http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02US Government Resource
Impacted products
Vendor Product Version
Cogent DataHub Version: 0   < 7.3.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:14:25.305Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DataHub",
          "vendor": "Cogent",
          "versions": [
            {
              "lessThan": "7.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alain Homewood"
        }
      ],
      "datePublic": "2014-05-29T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\nThe directory specifier can include designators that can be used to \ntraverse the directory path. Exploiting this vulnerability may enable an\n attacker to access a limited number of hardcoded file types. Further \nexploitation of this vulnerability may allow an attacker to cause the \nweb server component to enter a denial-of-service condition.\n\n\u003c/p\u003e"
            }
          ],
          "value": "The directory specifier can include designators that can be used to \ntraverse the directory path. Exploiting this vulnerability may enable an\n attacker to access a limited number of hardcoded file types. Further \nexploitation of this vulnerability may allow an attacker to cause the \nweb server component to enter a denial-of-service condition."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-03T16:31:41.797Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02"
        },
        {
          "url": "http://cogentdatahub.com/Download_Software.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCogent Real-Time Systems, Inc. has produced a new version of the \nCogent DataHub application, Version 7.3.5, that fixes three of the four \nidentified vulnerabilities. The updated version is available at the \nfollowing address:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://cogentdatahub.com/Download_Software.html\"\u003ehttp://cogentdatahub.com/Download_Software.html\u003c/a\u003e\u003c/p\u003eCogent\n has indicated that it will not be fixing the cryptographic weaknesses \nof hashed usernames and passwords because of compatibility issues with \nexisting systems. Cogent and the researcher agree that an effective \nmitigation strategy for users is to select sufficiently strong \npasswords. Cogent has indicated that password hashes can be checked for \nstrength using sites such as: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://crackstation.net/\"\u003ehttps://crackstation.net/\u003c/a\u003e.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Cogent Real-Time Systems, Inc. has produced a new version of the \nCogent DataHub application, Version 7.3.5, that fixes three of the four \nidentified vulnerabilities. The updated version is available at the \nfollowing address:\n\n\n http://cogentdatahub.com/Download_Software.html \n\nCogent\n has indicated that it will not be fixing the cryptographic weaknesses \nof hashed usernames and passwords because of compatibility issues with \nexisting systems. Cogent and the researcher agree that an effective \nmitigation strategy for users is to select sufficiently strong \npasswords. Cogent has indicated that password hashes can be checked for \nstrength using sites such as:  https://crackstation.net/ ."
        }
      ],
      "source": {
        "advisory": "ICSA-14-149-02",
        "discovery": "EXTERNAL"
      },
      "title": "Cogent DataHub Path Traversal",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-2352",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to read arbitrary files of unspecified types, or cause a web-server denial of service, via a crafted pathname."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02",
              "refsource": "MISC",
              "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-2352",
    "datePublished": "2014-05-30T23:00:00",
    "dateReserved": "2014-03-13T00:00:00",
    "dateUpdated": "2025-10-03T16:31:41.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-2352\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2014-05-30T23:55:02.847\",\"lastModified\":\"2025-10-03T17:15:45.107\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The directory specifier can include designators that can be used to \\ntraverse the directory path. Exploiting this vulnerability may enable an\\n attacker to access a limited number of hardcoded file types. Further \\nexploitation of this vulnerability may allow an attacker to cause the \\nweb server component to enter a denial-of-service condition.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de salto de directorio en Cogent DataHub anterior a 7.3.5 permite a atacantes remotos leer archivos arbitrarios de tipos no especificados, o causar una denegaci\u00f3n de servicio de servidor web, a trav\u00e9s de un nombre de ruta manipulado.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:N/A:N\",\"baseScore\":7.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:P\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.3.4\",\"matchCriteriaId\":\"3A416FED-E221-48CE-8AFB-D822C6C8E4FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2DE7A08-D283-4EB3-BAAE-0BA4A8C2E088\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66059E64-6EB2-4F9D-BCB3-099A01C9E72A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F05AAB16-437D-4A4E-892B-9B83E47FEC24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65D16B36-567F-499D-AC7B-D2CC85AD9327\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1.63:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8EC08FD-5473-4DB6-9828-8D007FE1E5FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2724B2F-49B9-4423-A8D5-95B1E81DDEF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C414FB06-9100-4BB9-9F5C-A31946C11E84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D881278E-D6B8-4147-91BA-4EBE049B0C70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3142AD5D-E5E1-447B-8FCD-444A31D62437\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"321C4D3C-67FF-4284-A569-8359B58FC2FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B5C1FCA-D64E-4C12-B3A4-4200F95C6315\"}]}]}],\"references\":[{\"url\":\"http://cogentdatahub.com/Download_Software.html\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.