VulnerabilityModified
CVE-2022-27906
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal.
MEDIUM 5.9EPSS 1.08%
Does this matter?
Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own.
Description
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.08% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- mendelson/oftp2
- Source
- cve@mitre.org
References
- https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/Technical Description, Third Party Advisory
- https://mendelson-e-c.com/node/3355Release Notes, Vendor Advisory
- https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/Technical Description, Third Party Advisory
- https://mendelson-e-c.com/node/3355Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.