CVE-2019-14251
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 7.8%
from disclosure to weapon
Published on NVDDec 9
VulnCheck+1497d
exploitation probability
7.8%top 6% of all CVEs
observed exploitation
yesVulnCheck
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer() to traverse the file system and access files or directories that are outside of the restricted directory because WealthT24/GetImage is used with the docDownloadPath and uploadLocation parameters.
Affected products
n/a · n/a