CVE-2023-6352 (published 2023-11-30T18:01:09.116Z)
The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.



Affected products: Vendor: Aquaforest
Product: TIFF Server
Versions: 0