A Path Traversal vulnerability exists in the eSignaViewer component of the eSigna product, affecting versions 1.0 to 1.5 across all platforms. This vulnerability allows unauthenticated attackers to access arbitrary files within the document system by manipulating file paths and object identifiers. The issue poses a risk to the confidentiality of sensitive information stored in the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2 | CVE-2024-12014 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the eSignaViewer component, manipulating the file paths and object identifiers to gain unauthorized access to files stored in the document system. This requires the attacker to have network access to the affected system and the ability to interact with the application.
Affected Products
- eSigna product versions 1.0 to 1.5: This product is vulnerable due to its eSignaViewer component, which allows for path traversal attacks.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of the eSigna product that addresses this issue. Additionally, implementing strict input validation and sanitization for file paths can help prevent unauthorized access to sensitive files.