Actions
Bug #17013
open
Path traversal when deleting Suricata IP Lists
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
The Suricata IP List page at suricata_ip_list_mgmt.php does not protect against path traversal when deleting IP list files.
Submitting iplist_fname with a path including traversal techniques will allow the submitter to remove arbitrary files.
Reported by: @lujiefsi
Updated by Jim Pingle 2 days ago
- Status changed from Confirmed to Feedback
- % Done changed from 0 to 100
- Private changed from Yes to No
Fixed in Suricata pkg v7.0.9
Actions
Also available in: Atom