Threats tagged 'ghsa-cc3q-3r4r-hm4q'

Huatian Dynamic OA8000 collaborative office system has an unauthenticated path traversal vulnerability in the /OAapp/jsp/trace/ntkodownload.jsp endpoint. The vulnerability arises because the filename parameter is not properly sanitized, allowing attackers to use ../ sequences to access arbitrary files on the server. This can expose sensitive files such as the Tomcat configuration (ROOT/WEB-INF/web.xml), potentially revealing configuration details and credentials. The vulnerability was first observed being exploited on 2024-11-20. The CVSS score is 7.5, indicating high severity.