title: TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Path Traversal
description: Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote attackers can apply Path Traversal means to download credential files from the system without permission.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
platforms: Door Access Control
product: Door Access Control and Personnel Attendance Management system
vendor: TAIWAN SECOM CO., LTD.,
versions:
lessThanOrEqual: 3.3.2, status: affected, version: unspecified, versionType: custom
}
{
platforms: Personnel Attendance system
product: Door Access Control and Personnel Attendance Management system
vendor: TAIWAN SECOM CO., LTD.,
versions:
lessThanOrEqual: 3.4.0.0.3.12_20210525, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: Update to:
Personnel Attendance system ver. 3.4.0.0.3.12_20210525