Path Traversal in Id Id-Software

CVE-2013-5648

Absolute path traversal vulnerability in the handleStartDataFile function in DigiDocSAXParser.c in libdigidoc 3.6.0.0, as used in ID-software before 3.7.2 and other products, allows remote attackers to overwrite arbitrary files via a filename beginning with / (slash) or \ (backslash) in a DDOC file.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.021 (79.3th percentile) — read the EPSS interpretation.

Affected products

Id Id-software — versions 3.7, 3.7.1
Id Libdigidoc — versions 3.6.0.0
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (x_refsource_CONFIRM, Patch)
cve@mitre.org (x_refsource_CONFIRM)