title: Elcomplus SmartPtt Path Traversal
description: Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: SmartPTT
vendor: Elcomplus
versions:
status: affected, version: 1.1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: Elcomplus has released an update to fix these vulnerabilities and recommends users upgrade to Version 2.3.4 or later.
For more information, please contact Elcomplus support.