Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Iobroker records in CISA KEVNo Iobroker vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 45
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01714 · Published 2019-11-20 · Fixed in 3.6.12 CWE-22
Priority LOW 37
An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin".
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02158 · Published 2019-11-21 · Fixed in 2.0.25 CWE-22
Priority LOW 28
Characters in the GET url path are not properly escaped and can be reflected in the server response.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00679 · Published 2019-11-25 · Fixed in 2.4.10 CWE-79
