2 lines
4.7 KiB
JSON
2 lines
4.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"FTP Backup","platforms":["Linux","x86","ARM","64 bit"],"product":"ADM","vendor":"ASUSTOR","versions":[{"lessThanOrEqual":"4.3.3.ROF1","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThanOrEqual":"5.1.2.RE51","status":"affected","version":"5.0.0","versionType":"custom"}]}],"source":"security@asustor.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*","matchCriteriaId":"662E4EA5-0C53-4669-947E-705E5E076B10","versionEndIncluding":"4.3.3.rof1","versionStartIncluding":"4.1.0.rhu2","vulnerable":true},{"criteria":"cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*","matchCriteriaId":"47B926F1-1D8F-4105-A533-45E0B4178C59","versionEndExcluding":"5.1.2.reo1","versionStartIncluding":"5.0.0.ra82","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write files outside the intended backup directory. A path traversal vulnerability may allow an attacker to overwrite arbitrary files on the system and potentially achieve privilege escalation or remote code execution.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51."},{"lang":"es","value":"La copia de seguridad FTP en el ADM no sanea correctamente los nombres de archivo recibidos del servidor FTP al analizar listados de directorios. Un servidor malicioso o atacante MitM puede crear nombres de archivo que contengan secuencias de salto de ruta, haciendo que el cliente escriba archivos fuera del directorio de copia de seguridad previsto. Una vulnerabilidad de salto de ruta puede permitir a un atacante sobrescribir archivos arbitrarios en el sistema y potencialmente lograr escalada de privilegios o ejecución remota de código.\nLos productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.ROF1, así como desde ADM 5.0.0 hasta ADM 5.1.2.RE51."}],"id":"CVE-2026-3179","lastModified":"2026-06-17T10:43:09.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@asustor.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-02-25T17:02:43.331354Z","version":"2.0.3"}}]},"published":"2026-02-25T06:16:27.597","references":[{"source":"security@asustor.com","tags":["Vendor Advisory"],"url":"https://www.asustor.com/security/security_advisory_detail?id=53"}],"sourceIdentifier":"security@asustor.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@asustor.com","type":"Secondary"}]}
|