title: Directory Traversal in OpenLiteSpeed Web Server
description: Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
defaultStatus: unaffected
product: OpenLiteSpeed Web Server
repo: https://github.com/litespeedtech/openlitespeed
vendor: LiteSpeed Technologies
versions:
lessThanOrEqual: 1.5.12, status: affected, version: 1.5.11, versionType: custom
lessThanOrEqual: 1.6.20.1, status: affected, version: 1.6.5, versionType: custom
lessThan: 1.7.16.1, status: affected, version: 1.7.0, versionType: custom
}
{
defaultStatus: unaffected
product: LiteSpeed Web Server
vendor: LiteSpeed Technologies
versions:
lessThanOrEqual: 1.5.12, status: affected, version: 1.5.11, versionType: custom
lessThanOrEqual: 1.6.20.1, status: affected, version: 1.6.5, versionType: custom
lessThan: 1.7.16.1, status: affected, version: 1.7.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL