CVE-2017-15363

Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://extensions.typo3.org/extension/download/restler/1.7.1/zip/	Vendor Advisory
https://extensions.typo3.org/extension/restler/	Product Vendor Advisory
https://extensions.typo3.org/extension/download/restler/1.7.1/zip/	Vendor Advisory
https://extensions.typo3.org/extension/restler/	Product Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:luracast:restler::::::typo3::*
	cpe:2.3:a:luracast:restler::::::-::*

History

No history.

Information

Published : 2017-10-15 19:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-15363

Mitre link : CVE-2017-15363

CVE.ORG link : CVE-2017-15363

JSON object : View

Products Affected

luracast

restler

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2017-15363", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-10-15T19:29:00.217", "references": [{"url": "https://extensions.typo3.org/extension/download/restler/1.7.1/zip/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://extensions.typo3.org/extension/restler/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://extensions.typo3.org/extension/download/restler/1.7.1/zip/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://extensions.typo3.org/extension/restler/", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en public/examples/resources/getsource.php en Luracast Restler, hasta la versi\u00f3n 3.0.0, como se utiliza en la extensi\u00f3n de restler anterior a la versi\u00f3n 1.7.1 para TYPO3, permite que atacantes remotos lean archivos arbitrarios mediante el par\u00e1metro file."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:luracast:restler:*:*:*:*:*:typo3:*:*", "vulnerable": true, "matchCriteriaId": "CED3CE79-D532-48F3-8DA5-7C2492B31FCC", "versionEndExcluding": "1.7.1"}, {"criteria": "cpe:2.3:a:luracast:restler:*:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "D6D50873-28E2-402C-A8BA-AD8F37BC0D3E", "versionEndExcluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}