var-202208-1438
Vulnerability from variot
FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains directory traversal characters to disclose the contents of files located outside of the server's restricted path. FLIR Systems, Inc. of flir ax8 A path traversal vulnerability exists in firmware.Information may be obtained. The AX8 helps you guard against unplanned outages, service interruptions, and equipment failure.
The FLIR AX series camera/sensor also has built-in support to connect to industrial control equipment such as programmable logic controllers (PLCs), and allows the sharing of analysis and alarm results and simple control using the Ethernet/IP and Modbus TCP field bus protocols. Compact and easy to install, the AX8 provides continuous monitoring of electrical cabinets, process and manufacturing areas, data centers, energy generation and distribution, transportation and mass transit, storage facilities and refrigeration warehouses.The FLIR AX8 thermal sensor camera suffers from an unauthenticated arbitrary file disclosure vulnerability. This can beexploited to disclose the contents of arbitrary files via absolute path.Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l)lighttpd/1.4.33PHP/5.4.14. # FLIR AX8 vulnerabilities.
Product description:
The FLIR AX8 is a thermal sensor with imaging capabilities, combining thermal and visual cameras that provides continuous temperature monitoring and alarming for critical electrical and mechanical equipment.
Summary of the 4 vulnerabilities found / What we were able to find:
- [CVE-2022-37061] - Unauthenticated OS Command Injection.
FLIR AX8 is affected by an unauthenticated remote command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges.
-
[CVE-2022-37060] - Unauthenticated Directory Traversal.
-
[CVE-2022-37062] - Improper Access Control. A successful exploit could allow the attacker to extract usernames and hashed passwords.
-
[CVE-2022-37063] - Reflected cross-site scripting.
FLIR AX8 is affected by a reflected cross-site scripting (XSS) vulnerability due to an improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code.
Step by Step Example (How to Reproduce and verify) the vulnerabilities:
- Unauthenticated Remote Command Injection.
The endpoint /res.php can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate. The second problem is that the POST parameter id can be injected to execute any Linux command. In the example below we create a crafted query that displays the contents of the /etc/shadow file.
The server returns a JSON response containing the contents of the /etc/shadow file. This command injection is due because there no sanitization check on the variable $_POST["id"], line 65, and can therefore take advantage of the shell_exec() function to execute unexpected arbitrary shell commands.
- Unauthenticated Directory Traversal.
The endpoint /download.php can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate. The second problem is that the GET parameter file can be injected with a relative file paths and download any files in the system. In the example below we create a crafted query that download the contents of the /etc/passwd file.
The error is due to the fact that there is no sanitization of the $file_path variable, line 26, when the fopen() function is called, line 39. However a comment in the code, line 24, and the use of the function pathinfo(), line 28, suggests that the developer thought about this problem and therefore created the variable $path_parts which is sanitized. But for some reasons the developer does not use the sanitizer variable $path_parts when the function fopen() is used. Probably an oversight.
- Improper Access Control.
The endpoint /FLIR/db/users.db can be called remotely without user authentication as there is no cookie verification Cookie: PHPSESSID=ID to check if the request is legitimate and let any malicious actor to download the users.db SQLite database.
- Reflected cross-site scripting.
In the settings tab, if a file with a filename that contains JavaScript code is selected via the update firmware file input the JavaScript code will be triggered and executed. In our example, we created a file call
.run
Recommendations for how to fix the 4 vulnerabilities:
- Vulnerability 1: The variable
$_POST["id"], line 65 in the file/FLIR/usr/www/res.php, must be sanitized using the functionintval()and will remove any character other than integer value.escapeshellcmd()andescapeshellarg()must be also used to escapes any characters in a string that might be used to execute arbitrary commands.
More info: https://www.php.net/intval https://www.php.net/manual/en/function.escapeshellcmd https://www.php.net/manual/en/function.escapeshellarg
- Vulnerability 2: The variable
$file_path, line 39 in the file/FLIR/usr/www/download.php, must be sanitized using the functionpathinfo()but also use a hard coded directory path, in case you need to manage several directories set a whitelist of all allowed directories and use multiple conditions.
More info: https://www.php.net/manual/en/function.pathinfo
- Vulnerability 3: Define a whitelist of all directories that a user is allowed to access. This can be added to the Lighttpd server configuration file, in
/etc/lighttpd.conf.
More info: https://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html
- Vulnerability 4: To protect against filename XSS attack you can use a regex that will parse the filename to leave only numbers and letters.
More info: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Reference:
https://www.flir.com/products/ax8-automation/
Security researchers:
- [Thomas Knudsen] (https://www.linkedin.com/in/thomasjknudsen)
- [Samy Younsi] (https://www.linkedin.com/in/samy-younsi)
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202208-1438",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ax8",
"scope": "lte",
"trust": 1.0,
"vendor": "flir",
"version": "1.46.16"
},
{
"model": "ax8",
"scope": "eq",
"trust": 0.8,
"vendor": "flir",
"version": null
},
{
"model": "ax8",
"scope": null,
"trust": 0.8,
"vendor": "flir",
"version": null
},
{
"model": "ax8",
"scope": "lte",
"trust": 0.8,
"vendor": "flir",
"version": "flir ax8 firmware 1.46.16 and earlier"
},
{
"model": "systems flir ax8 thermal camera",
"scope": "eq",
"trust": 0.1,
"vendor": "flir",
"version": "1.17.13"
},
{
"model": "systems flir ax8 thermal camera",
"scope": "eq",
"trust": 0.1,
"vendor": "flir",
"version": "os: neco_v1.8-0-g7ffe5b3"
},
{
"model": "systems flir ax8 thermal camera",
"scope": "eq",
"trust": 0.1,
"vendor": "flir",
"version": "hardware: flir systems neco board"
}
],
"sources": [
{
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Samy Younsi",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202208-3364"
}
],
"trust": 0.6
},
"cve": "CVE-2022-37060",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2022-37060",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-37060",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-37060",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-37060",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202208-3364",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "ZSL",
"id": "ZSL-2018-5493",
"trust": 0.1,
"value": "(4/5)"
}
]
}
],
"sources": [
{
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-3364"
},
{
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains directory traversal characters to disclose the contents of files located outside of the server\u0027s restricted path. FLIR Systems, Inc. of flir ax8 A path traversal vulnerability exists in firmware.Information may be obtained. The AX8 helps you guard against unplanned outages, service interruptions, and equipment failure.\u003cbr/\u003e\u003cbr/\u003e The FLIR AX series camera/sensor also has built-in support to connect to industrial control equipment such as programmable logic controllers (PLCs), and allows the sharing of analysis and alarm results and simple control using the Ethernet/IP and Modbus TCP field bus protocols. Compact and easy to install, the AX8 provides continuous monitoring of electrical cabinets, process and manufacturing areas, data centers, energy generation and distribution, transportation and mass transit, storage facilities and refrigeration warehouses.The FLIR AX8 thermal sensor camera suffers from an unauthenticated arbitrary file disclosure vulnerability. This can beexploited to disclose the contents of arbitrary files via absolute path.Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l)lighttpd/1.4.33PHP/5.4.14. # FLIR AX8 vulnerabilities. \n\n### Product description:\n\nThe FLIR AX8 is a thermal sensor with imaging capabilities, combining thermal and visual cameras that provides continuous temperature monitoring and alarming for critical electrical and mechanical equipment. \n\n\n### Summary of the 4 vulnerabilities found / What we were able to find:\n\n* [CVE-2022-37061] - Unauthenticated OS Command Injection. \n\nFLIR AX8 is affected by an unauthenticated remote command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user through the `id` HTTP POST parameter in `res.php` endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. \n\n* [CVE-2022-37060] - Unauthenticated Directory Traversal. \n\n* [CVE-2022-37062] - Improper Access Control. A successful exploit could allow the attacker to extract usernames and hashed passwords. \n\n* [CVE-2022-37063] - Reflected cross-site scripting. \n\nFLIR AX8 is affected by a reflected cross-site scripting (XSS) vulnerability due to an improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code. \n\n### Step by Step Example (How to Reproduce and verify) the vulnerabilities:\n\n1. Unauthenticated Remote Command Injection. \n\nThe endpoint `/res.php` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate. The second problem is that the POST parameter `id` can be injected to execute any Linux command. In the example below we create a crafted query that displays the contents of the `/etc/shadow` file. \n\nThe server returns a JSON response containing the contents of the `/etc/shadow` file. This command injection is due because there no sanitization check on the variable `$_POST[\"id\"]`, line 65, and can therefore take advantage of the `shell_exec()` function to execute unexpected arbitrary shell commands. \n\n2. Unauthenticated Directory Traversal. \n\nThe endpoint `/download.php` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate. The second problem is that the GET parameter `file` can be injected with a relative file paths and download any files in the system. In the example below we create a crafted query that download the contents of the `/etc/passwd` file. \n\nThe error is due to the fact that there is no sanitization of the `$file_path` variable, line 26, when the `fopen()` function is called, line 39. However a comment in the code, line 24, and the use of the function `pathinfo()`, line 28, suggests that the developer thought about this problem and therefore created the variable `$path_parts` which is sanitized. But for some reasons the developer does not use the sanitizer variable `$path_parts` when the function `fopen()` is used. Probably an oversight. \n\n3. Improper Access Control. \n\nThe endpoint `/FLIR/db/users.db` can be called remotely without user authentication as there is no cookie verification `Cookie: PHPSESSID=ID` to check if the request is legitimate and let any malicious actor to download the `users.db` SQLite database. \n\n4. Reflected cross-site scripting. \n\nIn the settings tab, if a file with a filename that contains JavaScript code is selected via the update firmware file input the JavaScript code will be triggered and executed. In our example, we created a file call \n\n\u003cimg src=x onerror=alert(String.fromCharCode(97,108,101,114,116,40,39,116,101,115,116,39,41,59));\u003e.run\n\n\n### Recommendations for how to fix the 4 vulnerabilities:\n\n* Vulnerability 1: The variable `$_POST[\"id\"]`, line 65 in the file `/FLIR/usr/www/res.php`, must be sanitized using the function `intval()` and will remove any character other than integer value. `escapeshellcmd()` and `escapeshellarg()` must be also used to escapes any characters in a string that might be used to execute arbitrary commands. \n\nMore info: \nhttps://www.php.net/intval\nhttps://www.php.net/manual/en/function.escapeshellcmd\nhttps://www.php.net/manual/en/function.escapeshellarg\n\n\n* Vulnerability 2: The variable `$file_path`, line 39 in the file `/FLIR/usr/www/download.php`, must be sanitized using the function `pathinfo()` but also use a hard coded directory path, in case you need to manage several directories set a whitelist of all allowed directories and use multiple conditions. \n\nMore info:\nhttps://www.php.net/manual/en/function.pathinfo\n\n* Vulnerability 3: Define a whitelist of all directories that a user is allowed to access. This can be added to the Lighttpd server configuration file, in `/etc/lighttpd.conf`. \n\nMore info:\nhttps://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html\n\n* Vulnerability 4: To protect against filename XSS attack you can use a regex that will parse the filename to leave only numbers and letters. \n\nMore info: \nhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n\n### Reference:\nhttps://www.flir.com/products/ax8-automation/\n\n### Security researchers:\n* [Thomas Knudsen] (https://www.linkedin.com/in/thomasjknudsen)\n* [Samy Younsi] (https://www.linkedin.com/in/samy-younsi) \n\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-37060"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"db": "PACKETSTORM",
"id": "168116"
}
],
"trust": 1.8
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.zeroscience.mk/codes/flir_ax8_fd.txt",
"trust": 0.1,
"type": "poc"
}
],
"sources": [
{
"db": "ZSL",
"id": "ZSL-2018-5493"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-37060",
"trust": 3.3
},
{
"db": "ZSL",
"id": "ZSL-2018-5493",
"trust": 2.5
},
{
"db": "PACKETSTORM",
"id": "168116",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014926",
"trust": 0.8
},
{
"db": "CXSECURITY",
"id": "WLB-2022080059",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202208-3364",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "149798",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "45597",
"trust": 0.1
}
],
"sources": [
{
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"db": "PACKETSTORM",
"id": "168116"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-3364"
},
{
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"id": "VAR-202208-1438",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-08-14T14:24:37.245000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.0
},
{
"problemtype": "Path traversal (CWE-22) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://packetstormsecurity.com/files/168116/flir-ax8-1.46.16-traversal-access-control-command-injection-xss.html"
},
{
"trust": 2.5,
"url": "https://www.flir.com/products/ax8-automation/"
},
{
"trust": 2.4,
"url": "https://gist.github.com/nwqda/9e16852ab7827dc62b8e44d6180a6899"
},
{
"trust": 2.4,
"url": "https://www.zeroscience.mk/en/vulnerabilities/zsl-2018-5493.php"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-37060"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-37060/"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022080059"
},
{
"trust": 0.1,
"url": "https://www.flir.com/security/best-practices-for-cybersecurity/"
},
{
"trust": 0.1,
"url": "https://www.flir.com/globalassets/security/flir-pro-security-cyber-hardening-guide.pdf"
},
{
"trust": 0.1,
"url": "https://www.flir.com/globalassets/security/cybersecurity-bulletin-10-12-18.pdf"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/45597/"
},
{
"trust": 0.1,
"url": "https://packetstormsecurity.com/files/149798"
},
{
"trust": 0.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/151285"
},
{
"trust": 0.1,
"url": "https://cheatsheetseries.owasp.org/cheatsheets/cross_site_scripting_prevention_cheat_sheet.html"
},
{
"trust": 0.1,
"url": "https://www.php.net/intval"
},
{
"trust": 0.1,
"url": "https://www.linkedin.com/in/thomasjknudsen)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-37062"
},
{
"trust": 0.1,
"url": "https://www.php.net/manual/en/function.pathinfo"
},
{
"trust": 0.1,
"url": "https://www.php.net/manual/en/function.escapeshellcmd"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-37061"
},
{
"trust": 0.1,
"url": "https://www.linkedin.com/in/samy-younsi)"
},
{
"trust": 0.1,
"url": "https://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html"
},
{
"trust": 0.1,
"url": "https://www.php.net/manual/en/function.escapeshellarg"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-37063"
}
],
"sources": [
{
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"db": "PACKETSTORM",
"id": "168116"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-3364"
},
{
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"db": "PACKETSTORM",
"id": "168116"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-3364"
},
{
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-14T00:00:00",
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"date": "2023-09-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"date": "2022-08-19T19:24:22",
"db": "PACKETSTORM",
"id": "168116"
},
{
"date": "2022-08-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202208-3364"
},
{
"date": "2022-08-18T17:15:08.033000",
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-17T00:00:00",
"db": "ZSL",
"id": "ZSL-2018-5493"
},
{
"date": "2023-09-22T08:25:00",
"db": "JVNDB",
"id": "JVNDB-2022-014926"
},
{
"date": "2022-11-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202208-3364"
},
{
"date": "2022-12-12T21:11:38.377000",
"db": "NVD",
"id": "CVE-2022-37060"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202208-3364"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "FLIR\u00a0Systems,\u00a0Inc.\u00a0 of \u00a0flir\u00a0ax8\u00a0 Path traversal vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-014926"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202208-3364"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…