CVE:CVE-2014-2575
CNNVD:CNNVD-201406-092
DevExpress ASPxFileManager Control for ASP.NET WebForms和MVC是美国DevExpress公司的一套用于ASP.NET WebForms和MVC框架中的DevExpress界面控件应用。
ASP.NET WebForms和MVC框架的DevExpress ASPxFileManager Control 13.1.10之前的版本，13.2.9之前的13.2.x版本中的File Manager组件存在目录遍历漏洞。远程攻击者可借助‘__EVENTARGUMENT’参数中的目录遍历字符（..）利用该漏洞读取任意文件。
solution:Upgrade devexpress aspxfilemanager_control_for_webforms_and_mvc to a higher version than 13.1.9,10.2,10.2.3,10.2.4,10.2.5,10.2.6,10.2.8,10.2.9,10.2.10,10.2.11,11.1,11.1.4,11.1.5,11.1.6,11.1.7,11.1.8,11.1.9,11.1.10,11.1.11,11.1.12,11.2,11.2.5,11.2.7,11.2.8,11.2.10,11.2.11,11.2.12,11.2.13,11.2.14,12.1,12.1.4,12.1.5,12.1.6,12.1.7,12.1.8,12.1.9,12.1.10,12.1.11,12.1.12,12.2,12.2.4,12.2.5,12.2.6,12.2.7,12.2.8,12.2.10,12.2.11,12.2.12,12.2.13,12.2.15,12.2.16,13.1,13.1.4,13.1.5,13.1.6,13.1.7,13.1.8,13.2,13.2.5,13.2.6,13.2.7,13.2.8,and avoid the version (,13.1.9],10.2,10.2.3,10.2.4,10.2.5,10.2.6,10.2.8,10.2.9,10.2.10,10.2.11,11.1,11.1.4,11.1.5,11.1.6,11.1.7,11.1.8,11.1.9,11.1.10,11.1.11,11.1.12,11.2,11.2.5,11.2.7,11.2.8,11.2.10,11.2.11,11.2.12,11.2.13,11.2.14,12.1,12.1.4,12.1.5,12.1.6,12.1.7,12.1.8,12.1.9,12.1.10,12.1.11,12.1.12,12.2,12.2.4,12.2.5,12.2.6,12.2.7,12.2.8,12.2.10,12.2.11,12.2.12,12.2.13,12.2.15,12.2.16,13.1,13.1.4,13.1.5,13.1.6,13.1.7,13.1.8,13.2,13.2.5,13.2.6,13.2.7,13.2.8