Hybris Commerce Software Suite CVE-2014-8871 Directory Traversal Vulnerability

Bugtraq ID:	72681
Class:	Input Validation Error
CVE:	CVE-2014-8871
Remote:	Yes
Local:	No
Published:	Feb 18 2015 12:00AM
Updated:	Feb 18 2015 12:00AM
Credit:	RedTeam Pentesting GmbH
Vulnerable:	Hybris Commerce Software Suite 5.3.0.1 Hybris Commerce Software Suite 5.2.0.3 Hybris Commerce Software Suite 5.1.1.2 Hybris Commerce Software Suite 5.1.0.1 Hybris Commerce Software Suite 5.0.4.4 Hybris Commerce Software Suite 5.0.3.3 Hybris Commerce Software Suite 5.0.0.3
Not Vulnerable:	Hybris Commerce Software Suite 5.3.0.2 Hybris Commerce Software Suite 5.2.0.4 Hybris Commerce Software Suite 5.1.1.3 Hybris Commerce Software Suite 5.1.0.2 Hybris Commerce Software Suite 5.0.4.5 Hybris Commerce Software Suite 5.0.3.4 Hybris Commerce Software Suite 5.0.0.4

Hybris Commerce Software Suite CVE-2014-8871 Directory Traversal Vulnerability

Hybris Commerce Software Suite is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.

Hybris Commerce Software Suite CVE-2014-8871 Directory Traversal Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Hybris Commerce Software Suite CVE-2014-8871 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Hybris Commerce Software Suite CVE-2014-8871 Directory Traversal Vulnerability

References:

• hybris Commerce Suite Home Page (hybris)
  
• Vendor Home Page (https://www.hybris.com/en/commerce)
  
• Directory Traversal and Arbitrary File Disclosure in hybris Commerce Software Su (redteam-pentesting)