CVE-2023-6352
Aquaforest TIFF Server default configuration allows access to arbitrary files
- State
- Published
- Severity
- 5.3 Medium
- Published
- Nov 30, 2023
- Updated
- Aug 2, 2024
- Reserved
- Nov 28, 2023
Description
The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | cisa-cg |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
TIFF ServerAquaforest |
|
References
- https://www.aquaforest.com/blog/tiff-server-security-updatevendor-advisory
- https://www.aquaforest.com/blog/aquaforest-tiff-server-sunsettingproduct
- https://www.aquaforest.com/wp-content/uploads/pdf/ts/TiffServer4.2.pdfproduct
- https://github.com/qwell/disorder-in-the-court/blob/main/README-TylerTechnologies.md
- https://www.cisa.gov/news-events/alerts/2023/11/30/multiple-vulnerabilities-affecting-web-based-court-case-and-document-management-systemsgovernment-resourcethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.