title: Arbitrary file upload vulnerability in FatPipe software
description: A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
affected:
{
vendor: FatPipe
product: WARP
versions:
version: 10.1, status: affected, lessThan: 10.1.2r60p92, versionType: custom
version: 10.2, status: affected, lessThan: 10.2.2r44p1, versionType: custom
}
{
vendor: FatPipe
product: IPVPN
versions:
version: 10.1, status: affected, lessThan: 10.1.2r60p92, versionType: custom
version: 10.2, status: affected, lessThan: 10.2.2r44p1, versionType: custom
}
{
vendor: FatPipe
product: MPVPN
versions:
version: 10.1, status: affected, lessThan: 10.1.2r60p92, versionType: custom
version: 10.2, status: affected, lessThan: 10.2.2r44p1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]