VulnerabilityModified
CVE-2019-11397
GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc parameter.
MEDIUM 6.5EPSS 5.48%
Does this matter?
Lower severity and a low EPSS score (5.48%). Track it; it rarely justifies an emergency change on its own.
Description
GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc parameter.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 5.48% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- rapidflows/rapid4 · microsoft/.net framework
- Source
- cve@mitre.org
References
- http://rapidflows.com/Product, Vendor Advisory, URL Repurposed
- https://medium.com/%40javarmutt/rapid4-local-file-inclusion-0day-151c830ac74a
- http://rapidflows.com/Product, Vendor Advisory, URL Repurposed
- https://medium.com/%40javarmutt/rapid4-local-file-inclusion-0day-151c830ac74a
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.