rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.
Vulnerability ID: CVE-2020-16088
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/openbsd/src
Published: 2020-07-28
File: sbin/iked/ca.c
Commit message: Fix return value check for openssl API used during pubkey validation.

Found thanks to bug report by Michael Scheibel <m.Scheibel (at) tuvit (dot) de>
ok patrick@, markus@, tb@
Commit author: tobhe

Vulnerable version (before fix):
 /*	$OpenBSD: ca.c,v 1.64 2020/07/15 14:45:15 tobhe Exp $	*/  /*  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org> ca_validate_pubkey(struct iked *env, struct iked_static_id *id, 	if (localkey == NULL) 		goto sslerr;  	if (peerkey && !EVP_PKEY_cmp(peerkey, localkey)) { 		log_debug("%s: public key does not match %s", __func__, file); 		goto done; 	}

Fixed version (after fix):
 /*	$OpenBSD: ca.c,v 1.65 2020/07/27 14:22:53 tobhe Exp $	*/  /*  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org> ca_validate_pubkey(struct iked *env, struct iked_static_id *id, 	if (localkey == NULL) 		goto sslerr;  	if (peerkey && EVP_PKEY_cmp(peerkey, localkey) != 1) { 		log_debug("%s: public key does not match %s", __func__, file); 		goto done; 	}

Patch:
patch: @@ -1,4 +1,4 @@
-/*	$OpenBSD: ca.c,v 1.64 2020/07/15 14:45:15 tobhe Exp $	*/
+/*	$OpenBSD: ca.c,v 1.65 2020/07/27 14:22:53 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
@@ -1420,7 +1420,7 @@ ca_validate_pubkey(struct iked *env, struct iked_static_id *id,
 	if (localkey == NULL)
 		goto sslerr;
 
-	if (peerkey && !EVP_PKEY_cmp(peerkey, localkey)) {
+	if (peerkey && EVP_PKEY_cmp(peerkey, localkey) != 1) {
 		log_debug("%s: public key does not match %s", __func__, file);
 		goto done;
 	}
path: sbin/iked/ca.c
Vulnerability: A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.
Vulnerability ID: CVE-2020-16587
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/AcademySoftwareFoundation/openexr
Published: 2020-12-09
File: OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
Commit message: Fix #491, issue with part number range check reconstructing chunk offset table

The chunk offset was incorrectly testing for a part number that was the
same size (i.e. an invalid index)

Signed-off-by: Kimball Thurston <kdt3rd@gmail.com>
Commit author: Kimball Thurston

Vulnerable version (before fix):
 MultiPartInputFile::Data::chunkOffsetReconstruction(OPENEXR_IMF_INTERNAL_NAMESPA                                                    if(partNumber<0 || partNumber> static_cast<int>(parts.size()))             {                 throw IEX_NAMESPACE::IoExc("part number out of range");             }

Fixed version (after fix):
 MultiPartInputFile::Data::chunkOffsetReconstruction(OPENEXR_IMF_INTERNAL_NAMESPA                                                    if(partNumber<0 || partNumber>= static_cast<int>(parts.size()))             {                 throw IEX_NAMESPACE::IoExc("part number out of range");             }

Patch:
patch: @@ -571,7 +571,7 @@ MultiPartInputFile::Data::chunkOffsetReconstruction(OPENEXR_IMF_INTERNAL_NAMESPA
             
             
             
-            if(partNumber<0 || partNumber> static_cast<int>(parts.size()))
+            if(partNumber<0 || partNumber>= static_cast<int>(parts.size()))
             {
                 throw IEX_NAMESPACE::IoExc("part number out of range");
             }
path: OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
Vulnerability: A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.
Vulnerability ID: CVE-2020-16588
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/AcademySoftwareFoundation/openexr
Published: 2020-12-09
File: OpenEXR/exrmakepreview/makePreview.cpp
Commit message: Fix logic for 1 pixel high/wide preview images (Fixes #493)
Commit author: Peter Hillman

Vulnerable version (before fix):
 generatePreview (const char inFileName[],     previewHeight = max (int (h / (w * a) * previewWidth + .5f), 1);     previewPixels.resizeErase (previewHeight, previewWidth);      float fx = (previewWidth  > 0)? (float (w - 1) / (previewWidth  - 1)): 1;     float fy = (previewHeight > 0)? (float (h - 1) / (previewHeight - 1)): 1;     float m  = Math<float>::pow (2.f, IMATH_NAMESPACE::clamp (exposure + 2.47393f, -20.f, 20.f));      for (int y = 0; y < previewHeight; ++y)

Fixed version (after fix):
 generatePreview (const char inFileName[],     previewHeight = max (int (h / (w * a) * previewWidth + .5f), 1);     previewPixels.resizeErase (previewHeight, previewWidth);      float fx = (previewWidth  > 1)? (float (w - 1) / (previewWidth  - 1)): 1;     float fy = (previewHeight > 1)? (float (h - 1) / (previewHeight - 1)): 1;     float m  = Math<float>::pow (2.f, IMATH_NAMESPACE::clamp (exposure + 2.47393f, -20.f, 20.f));      for (int y = 0; y < previewHeight; ++y)

Patch:
patch: @@ -120,8 +120,8 @@ generatePreview (const char inFileName[],
     previewHeight = max (int (h / (w * a) * previewWidth + .5f), 1);
     previewPixels.resizeErase (previewHeight, previewWidth);
 
-    float fx = (previewWidth  > 0)? (float (w - 1) / (previewWidth  - 1)): 1;
-    float fy = (previewHeight > 0)? (float (h - 1) / (previewHeight - 1)): 1;
+    float fx = (previewWidth  > 1)? (float (w - 1) / (previewWidth  - 1)): 1;
+    float fy = (previewHeight > 1)? (float (h - 1) / (previewHeight - 1)): 1;
     float m  = Math<float>::pow (2.f, IMATH_NAMESPACE::clamp (exposure + 2.47393f, -20.f, 20.f));
 
     for (int y = 0; y < previewHeight; ++y)
path: OpenEXR/exrmakepreview/makePreview.cpp
Vulnerability: A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file.
Vulnerability ID: CVE-2020-16589
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/AcademySoftwareFoundation/openexr
Published: 2020-12-09
File: OpenEXR/IlmImf/ImfTiledInputFile.cpp
Commit message: Fix for #494: validate tile coordinates when doing copyPixels
Commit author: Peter Hillman

Vulnerable version (before fix):
 TiledInputFile::rawTileData (int &dx, int &dy,                 throw IEX_NAMESPACE::ArgExc ("rawTileData read the wrong tile");             }         }         pixelData = tileBuffer->buffer;     }     catch (IEX_NAMESPACE::BaseExc &e)

Fixed version (after fix):
 TiledInputFile::rawTileData (int &dx, int &dy,                 throw IEX_NAMESPACE::ArgExc ("rawTileData read the wrong tile");             }         }         else         {              if(!isValidTile (dx, dy, lx, ly) )              {                  throw IEX_NAMESPACE::IoExc ("rawTileData read an invalid tile");              }         }         pixelData = tileBuffer->buffer;     }     catch (IEX_NAMESPACE::BaseExc &e)

Patch:
patch: @@ -1313,6 +1313,13 @@ TiledInputFile::rawTileData (int &dx, int &dy,
                 throw IEX_NAMESPACE::ArgExc ("rawTileData read the wrong tile");
             }
         }
+        else
+        {
+             if(!isValidTile (dx, dy, lx, ly) )
+             {
+                 throw IEX_NAMESPACE::IoExc ("rawTileData read an invalid tile");
+             }
+        }
         pixelData = tileBuffer->buffer;
     }
     catch (IEX_NAMESPACE::BaseExc &e)
path: OpenEXR/IlmImf/ImfTiledInputFile.cpp
Vulnerability: An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
Vulnerability ID: CVE-2020-1763
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libreswan/libreswan
Published: 2020-05-12
File: programs/pluto/ikev1.c
Commit message: security: Fix for CVE-2020-1763

pluto will crash on a null pointer dereference when trying to log an error
for an IKEv1 packet containing bogus information and/or flags.

Signed-off-by: Paul Wouters <pwouters@redhat.com>
Commit author: D. Hugh Redelmeier

Vulnerable version (before fix):
 void process_packet_tail(struct msg_digest *md) 						"%smessage ignored because it contains a payload type (%s) unexpected by state %s", 						excuse, 						enum_show(&ikev1_payload_names, np), 						st->st_state->name); 					if (!md->encrypted) { 						SEND_NOTIFICATION(INVALID_PAYLOAD_TYPE); 					}

Fixed version (after fix):
 void process_packet_tail(struct msg_digest *md) 						"%smessage ignored because it contains a payload type (%s) unexpected by state %s", 						excuse, 						enum_show(&ikev1_payload_names, np), 						finite_states[smc->state]->name); 					if (!md->encrypted) { 						SEND_NOTIFICATION(INVALID_PAYLOAD_TYPE); 					}

Patch:
patch: @@ -2129,7 +2129,7 @@ void process_packet_tail(struct msg_digest *md)
 						"%smessage ignored because it contains a payload type (%s) unexpected by state %s",
 						excuse,
 						enum_show(&ikev1_payload_names, np),
-						st->st_state->name);
+						finite_states[smc->state]->name);
 					if (!md->encrypted) {
 						SEND_NOTIFICATION(INVALID_PAYLOAD_TYPE);
 					}
path: programs/pluto/ikev1.c
Vulnerability: An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read on function ilst_item_Read.
Vulnerability ID: CVE-2020-19488
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-07-21
File: src/isomedia/box_code_apple.c
Commit message: fixed potential crash - cf #1263
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err ilst_item_box_read(GF_Box *s,GF_BitStream *bs) 	if (sub_type == GF_ISOM_BOX_TYPE_DATA ) { 		e = gf_isom_box_parse(&a, bs);  		if (!e && ptr->size < a->size) { 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[isom] not enough bytes in box %s: %d left, reading %d (file %s, line %d)\n", gf_4cc_to_str(ptr->type), ptr->size, a->size, __FILE__, __LINE__ )); \ 			e = GF_ISOM_INVALID_FILE; 		} 		if (e) { 			if (a) gf_isom_box_del(a); 			return e; 		}  		ISOM_DECREASE_SIZE(ptr, a->size); 

Fixed version (after fix):
 GF_Err ilst_item_box_read(GF_Box *s,GF_BitStream *bs) 	if (sub_type == GF_ISOM_BOX_TYPE_DATA ) { 		e = gf_isom_box_parse(&a, bs);  		if (!e && a && (ptr->size < a->size)) { 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[isom] not enough bytes in box %s: %d left, reading %d (file %s, line %d)\n", gf_4cc_to_str(ptr->type), ptr->size, a->size, __FILE__, __LINE__ )); \ 			e = GF_ISOM_INVALID_FILE; 		} 		if (e) { 			if (a) gf_isom_box_del(a); 			return e; 		} 		if (!a) return GF_NON_COMPLIANT_BITSTREAM;  		ISOM_DECREASE_SIZE(ptr, a->size); 

Patch:
patch: @@ -112,14 +112,15 @@ GF_Err ilst_item_box_read(GF_Box *s,GF_BitStream *bs)
 	if (sub_type == GF_ISOM_BOX_TYPE_DATA ) {
 		e = gf_isom_box_parse(&a, bs);
 
-		if (!e && ptr->size < a->size) {
+		if (!e && a && (ptr->size < a->size)) {
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[isom] not enough bytes in box %s: %d left, reading %d (file %s, line %d)\n", gf_4cc_to_str(ptr->type), ptr->size, a->size, __FILE__, __LINE__ )); \
 			e = GF_ISOM_INVALID_FILE;
 		}
 		if (e) {
 			if (a) gf_isom_box_del(a);
 			return e;
 		}
+		if (!a) return GF_NON_COMPLIANT_BITSTREAM;
 
 		ISOM_DECREASE_SIZE(ptr, a->size);
path: src/isomedia/box_code_apple.c
Vulnerability: There is an invalid memory access bug in cgif.c that leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial of service or possibly unspecified other impact.
Vulnerability ID: CVE-2020-19491
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/pts/sam2p
Published: 2021-07-21
File: cgif.c
Commit message: fixed segfault in GIF reading; this fixes https://github.com/pts/sam2p/issues/67
Commit author: Peter Szabo

Vulnerable version (before fix):
 int CGIFFF DGifSlurp(CGIFFF GifFileType *GifFile)   			  memcpy(ep->Bytes,ExtData,ep->ByteCount * sizeof(char));   			#else   			  if (ExtData==NULL) break;   			  AddExtensionBlock(sp, ExtData[0], ExtData+1);   			#endif 		    } 		}

Fixed version (after fix):
 int CGIFFF DGifSlurp(CGIFFF GifFileType *GifFile)   			  memcpy(ep->Bytes,ExtData,ep->ByteCount * sizeof(char));   			#else   			  if (ExtData==NULL) break;                           AddExtensionBlock(&ext, ExtData[0], ExtData+1);                           ext.ExtensionBlocks[ext.ExtensionBlockCount-1].code=ext_code;   			#endif 		    } 		}

Patch:
patch: @@ -1551,7 +1551,8 @@ int CGIFFF DGifSlurp(CGIFFF GifFileType *GifFile)
   			  memcpy(ep->Bytes,ExtData,ep->ByteCount * sizeof(char));
   			#else
   			  if (ExtData==NULL) break;
-  			  AddExtensionBlock(sp, ExtData[0], ExtData+1);
+                          AddExtensionBlock(&ext, ExtData[0], ExtData+1);
+                          ext.ExtensionBlocks[ext.ExtensionBlockCount-1].code=ext_code;
   			#endif
 		    }
 		}
path: cgif.c
Vulnerability: Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy.
Vulnerability ID: CVE-2020-19858
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/plutinosoft/Platinum
Published: 2022-01-21
File: Source/Core/PltHttpServer.cpp
Commit message: Fix vulnerability around urls crafter as http://host/../secret.foo (#24)
Commit author: Sylvain Rebaud

Vulnerable version (before fix):
 PLT_HttpServer::ServeFile(const NPT_HttpRequest&        request,     NPT_FileInfo             file_info;          // prevent hackers from accessing files outside of our root     if ((file_path.Find("/..") >= 0) || (file_path.Find("\\..") >= 0) ||         NPT_FAILED(NPT_File::GetInfo(file_path, &file_info))) {         return NPT_ERROR_NO_SUCH_ITEM;     }

Fixed version (after fix):
 PLT_HttpServer::ServeFile(const NPT_HttpRequest&        request,     NPT_FileInfo             file_info;          // prevent hackers from accessing files outside of our root     if ((file_path.Find("../") >= 0) || (file_path.Find("..\\") >= 0) ||         NPT_FAILED(NPT_File::GetInfo(file_path, &file_info))) {         return NPT_ERROR_NO_SUCH_ITEM;     }

Patch:
patch: @@ -190,7 +190,7 @@ PLT_HttpServer::ServeFile(const NPT_HttpRequest&        request,
     NPT_FileInfo             file_info;
     
     // prevent hackers from accessing files outside of our root
-    if ((file_path.Find("/..") >= 0) || (file_path.Find("\\..") >= 0) ||
+    if ((file_path.Find("../") >= 0) || (file_path.Find("..\\") >= 0) ||
         NPT_FAILED(NPT_File::GetInfo(file_path, &file_info))) {
         return NPT_ERROR_NO_SUCH_ITEM;
     }
path: Source/Core/PltHttpServer.cpp
Vulnerability: An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10 and earlier can be abused to cause a crash and could potentially lead to remote code execution.
Vulnerability ID: CVE-2020-20276
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/troglobit/uftpd
Published: 2020-12-18
File: src/ftpcmd.c
Commit message: FTP: Fix buffer overflow in PORT parser, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
Commit author: Joachim Nilsson

Vulnerable version (before fix):
 static void handle_PORT(ctrl_t *ctrl, char *str)  	/* Convert PORT command's argument to IP address + port */ 	sscanf(str, "%d,%d,%d,%d,%d,%d", &a, &b, &c, &d, &e, &f); 	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);  	/* Check IPv4 address using inet_aton(), throw away converted result */ 	if (!inet_aton(addr, &(sin.sin_addr))) {

Fixed version (after fix):
 static void handle_PORT(ctrl_t *ctrl, char *str)  	/* Convert PORT command's argument to IP address + port */ 	sscanf(str, "%d,%d,%d,%d,%d,%d", &a, &b, &c, &d, &e, &f); 	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);  	/* Check IPv4 address using inet_aton(), throw away converted result */ 	if (!inet_aton(addr, &(sin.sin_addr))) {

Patch:
patch: @@ -441,7 +441,7 @@ static void handle_PORT(ctrl_t *ctrl, char *str)
 
 	/* Convert PORT command's argument to IP address + port */
 	sscanf(str, "%d,%d,%d,%d,%d,%d", &a, &b, &c, &d, &e, &f);
-	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);
+	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);
 
 	/* Check IPv4 address using inet_aton(), throw away converted result */
 	if (!inet_aton(addr, &(sin.sin_addr))) {
path: src/ftpcmd.c
Vulnerability: There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.
Vulnerability ID: CVE-2020-20277
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/troglobit/uftpd
Published: 2020-12-18
File: src/common.c
Commit message: FTP/TFTP: Fix directory traversal regression, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
Commit author: Joachim Nilsson

Vulnerable version (before fix):
 char *compose_path(ctrl_t *ctrl, char *path) 		strlcat(rpath, name, sizeof(rpath)); 	}  	if (!chrooted && strncmp(dir, home, strlen(home))) { 		DBG("Failed non-chroot dir:%s vs home:%s", dir, home); 		return NULL; 	}

Fixed version (after fix):
 char *compose_path(ctrl_t *ctrl, char *path) 		strlcat(rpath, name, sizeof(rpath)); 	}  	if (!chrooted && strncmp(rpath, home, strlen(home))) { 		DBG("Failed non-chroot dir:%s vs home:%s", dir, home); 		return NULL; 	}

Patch:
patch: @@ -92,7 +92,7 @@ char *compose_path(ctrl_t *ctrl, char *path)
 		strlcat(rpath, name, sizeof(rpath));
 	}
 
-	if (!chrooted && strncmp(dir, home, strlen(home))) {
+	if (!chrooted && strncmp(rpath, home, strlen(home))) {
 		DBG("Failed non-chroot dir:%s vs home:%s", dir, home);
 		return NULL;
 	}
path: src/common.c
Vulnerability: Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\devices\device_imports.php.
Vulnerability ID: CVE-2020-21053
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2021-05-20
File: app/devices/device_imports.php
Commit message: Update device_imports.php
Commit author: FusionPBX

Vulnerable version (before fix):
 function get_parent($schema,$table_name) { 	echo "		".$text['description-import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='devices.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Fixed version (after fix):
 function get_parent($schema,$table_name) { 	echo "		".$text['description-import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='devices.php'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Patch:
patch: @@ -363,7 +363,7 @@ function get_parent($schema,$table_name) {
 	echo "		".$text['description-import']."\n";
 	echo "	</td>\n";
 	echo "	<td valign='top' width='70%' align='right'>\n";
-	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='devices.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n";
+	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='devices.php'\" value='".$text['button-back']."'>\n";
 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n";
 	echo "	</td>\n";
 	echo "	</tr>\n";
path: app/devices/device_imports.php
Vulnerability: A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3) newfilename variables in app\edit\filerename.php.
Vulnerability ID: CVE-2020-21055
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2021-05-20
File: app/edit/file_rename.php
Commit message: Update and rename filerename.php to file_rename.php
Commit author: FusionPBX

Vulnerable version (before fix):
 	James Rose <james.o.rose@gmail.com> */  //includes 	include "root.php"; 	require_once "resources/require.php"; 		//echo "folder: ".$folder."<br>"; 		//echo "orig filename: ".$filename."<br>";; 		rename($folder.$filename, $folder.$newfilename); 		header("Location: fileoptions.php"); 	} 	else { 		//create the token

Fixed version (after fix):
 	James Rose <james.o.rose@gmail.com> */  //disable this feature 	exit;  //includes 	include "root.php"; 	require_once "resources/require.php"; 		//echo "folder: ".$folder."<br>"; 		//echo "orig filename: ".$filename."<br>";; 		rename($folder.$filename, $folder.$newfilename); 		header("Location: file_options.php"); 	} 	else { 		//create the token

Patch:
patch: @@ -25,6 +25,9 @@
 	James Rose <james.o.rose@gmail.com>
 */
 
+//disable this feature
+	exit;
+
 //includes
 	include "root.php";
 	require_once "resources/require.php";
@@ -65,7 +68,7 @@
 		//echo "folder: ".$folder."<br>";
 		//echo "orig filename: ".$filename."<br>";;
 		rename($folder.$filename, $folder.$newfilename);
-		header("Location: fileoptions.php");
+		header("Location: file_options.php");
 	}
 	else {
 		//create the token
path: app/edit/file_rename.php
Vulnerability: Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale to app\edit\foldernew.php.
Vulnerability ID: CVE-2020-21056
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2021-05-20
File: app/edit/folder_new.php
Commit message: Update and rename foldernew.php to folder_new.php
Commit author: FusionPBX

Vulnerable version (before fix):
 	James Rose <james.o.rose@gmail.com> */  //includes 	include "root.php"; 	require_once "resources/require.php"; 	require_once "resources/check_auth.php";  	//check permissions 	if (permission_exists('script_editor_save')) { 		//access granted 	}  		//create new folder 		mkdir($folder.'/'.$foldername); //, 0700 		header("Location: fileoptions.php"); 	} 	else { 

Fixed version (after fix):
 	James Rose <james.o.rose@gmail.com> */  //disable this feature 	exit;  //includes 	include "root.php"; 	require_once "resources/require.php"; 	require_once "resources/check_auth.php";  //check permissions 	if (permission_exists('script_editor_save')) { 		//access granted 	}  		//create new folder 		mkdir($folder.'/'.$foldername); //, 0700 		header("Location: file_options.php"); 	} 	else { 

Patch:
patch: @@ -25,12 +25,15 @@
 	James Rose <james.o.rose@gmail.com>
 */
 
+//disable this feature
+	exit;
+
 //includes
 	include "root.php";
 	require_once "resources/require.php";
 	require_once "resources/check_auth.php";
 
-	//check permissions
+//check permissions
 	if (permission_exists('script_editor_save')) {
 		//access granted
 	}
@@ -61,7 +64,7 @@
 
 		//create new folder
 		mkdir($folder.'/'.$foldername); //, 0700
-		header("Location: fileoptions.php");
+		header("Location: file_options.php");
 	}
 	else {
path: app/edit/folder_new.php