title: Path Traversal in NetModule NSRW
description: The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges.
This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
defaultStatus: unaffected
modules: web administration interface
product: NSRW
vendor: NetModule
versions:
lessThan: 4.3.0.119, status: affected, version: 4.3.0.0, versionType: 4.3.0.119
lessThan: 4.4.0.118, status: affected, version: 4.4.0.0, versionType: 4.4.0.118
lessThan: 4.6.0.105, status: affected, version: 4.6.0.0, versionType: 4.6.0.105
lessThan: 4.7.0.103, status: affected, version: 4.7.0.0, versionType: 4.7.0.103
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL