CVE-2019-12276
CVE-2019-12276
Vexday Risk Score
72High priority
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 53.7%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
05 Jun 2019Published on NVD
24 Jun 2019Public PoC
Weaponization speed
18 daysto first PoC
Recommendation: Patch as soon as possible — active exploitation confirmed.
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.htmlunverifiedexploitdbwww.exploit-db.com/exploits/47027unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.