CWE Code: 22
Vulnerability Type: privilege_escalation
CVSS Score: 7.5
CWE Name:  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary: an issue was discovered in thomson reuters desktop extensions 1.9.0.358. an unauthenticated directory traversal and local file inclusion vulnerability in the thomsonreuters.desktop.service.exe and thomsonreuters.desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. additionally, this could allow for privilege escalation by dumping the affected machine's sam and system database files, as well as remote code execution.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-06-05
Last Modified Date: 2019-06-06