title: Relative path traversal in Setelsa Security ConacWin CB
description: Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.
problem types: CWE-23: Relative Path Traversal
affected:
{
defaultStatus: unaffected
product: ConacWin CB
vendor: Setelsa Security
versions:
lessThanOrEqual: 3.8.2.2, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Setelsa Security has released version 3.8.2.3, which resolves the reported vulnerability.