CVE-2024-33620: fsas technologies inc. fujitsu business application id link manager ii Absolute Path Traversal

Vulnerability summary

CVE-2024-33620 is a high (CVSS 8.6) Absolute Path Traversal vulnerability in fsas technologies inc. fujitsu business application id link manager ii. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.4% of scored vulnerabilities.

Timeline

1. 18-06-2024
   PublishedVulnerability first disclosed.
2. 13-08-2024
   Last modifiedVulnerability information updated.

Description

Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker.

• CWE-36Absolute Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.