CWE Code: 22
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary: analysis of the bomgar remote support portal javastart.jar applet 52790 and earlier revealed that it is vulnerable to a path traversal vulnerability. the archive can be downloaded from a given bomgar remote support portal deployment at https://domain/api/content/javastart.jar and is callable from an arbitrary website using <object> and/or <applethtml> tags. successful exploitation results in file creation/modification/deletion in the operating system and with privileges of the user that ran the java applet.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-03-26
Last Modified Date: 2018-10-09