Threats tagged 'ghsa-ppvf-phq2-5chq'

Tobit Laboratories AG TeamDavid's Webbox has a vulnerability in its move archive functionality (!ArcEntryMove) that accepts arbitrary paths, including UNC network paths. This lack of validation allows unauthenticated attackers to cause the server to initiate outbound SMB connections to attacker-controlled servers, potentially exposing NTLM authentication information. This can lead to SMB relay or credential theft attacks if outbound SMB connections are allowed. The issue affects TeamDavid through Rollout 524.