Path Traversal in Ge Mds Pulsenet

CVE-2015-6459

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.031 (86.2th percentile) — read the EPSS interpretation.

Affected products

Ge Mds_pulsenet
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Vendor Advisory)
ics-cert@hq.dhs.gov (x_refsource_MISC)
ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)