title: Hgiga OAKlouds - Arbitrary File Read And Delete
description: The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
defaultStatus: unaffected
modules: [OAKlouds-organization-2.0, OAKlouds-organization-3.0]
product: OAKlouds
vendor: Hgiga
versions:
lessThan: 188, status: affected, version:  , versionType: custom
}
{
defaultStatus: unaffected
modules: [OAKlouds-webbase-2.0, OAKlouds-webbase-3.0]
product: OAKlouds
vendor: Hgiga
versions:
lessThan: 1051, status: affected, version:  , versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update OAKlouds-organization-2.0 to 188 or later version
Update OAKlouds-organization-3.0 to 188 or later version
Update OAKlouds-webbase-2.0 to 1051 or later version
Update OAKlouds-webbase-3.0 to 1051 or later version