| عنوان | WuKongOpenSource WukongCRM v11.0 System Path Disclosure(CWE-209) |
|---|
| الوصف | A system path disclosure vulnerability exists in the /adminFile/upload endpoint. The application’s DTO (Data Transfer Object) layer is improperly configured, causing it to directly return the full entity object to the frontend. As a result, sensitive information such as the real file storage path on the server is exposed in API responses. This information can be leveraged by attackers to gain insights into the server’s file structure, increasing the risk of further exploitation. |
|---|
| المصدر | ⚠️ https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26 |
|---|
| المستخدم | meraklbz (UID 87053) |
|---|
| ارسال | 29/07/2025 11:31 AM (9 أشهر منذ) |
|---|
| الاعتدال | 10/08/2025 09:08 PM (12 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 319383 [WuKongOpenSource WukongCRM 11.0 API Response /adminFile/upload الكشف عن المعلومات] |
|---|
| النقاط | 20 |
|---|