CVE-2015-2875

Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.
References
Link Resource
https://www.kb.cert.org/vuls/id/903500 Third Party Advisory US Government Resource
https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH Third Party Advisory US Government Resource
https://www.kb.cert.org/vuls/id/GWAN-A26L3F Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:h:seagate:goflex_sattelite:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:h:seagate:wireless_mobile_storage:*:*:*:*:*:*:*:*
cpe:2.3:h:seagate:wireless_plus_mobile_storage:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:h:lacie:lac9000436u:*:*:*:*:*:*:*:*
cpe:2.3:h:lacie:lac9000464u:*:*:*:*:*:*:*:*
OR cpe:2.3:o:lacie:lac9000436u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lacie:lac9000464u_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-12-31 05:59

Updated : 2023-12-10 11:46


NVD link : CVE-2015-2875

Mitre link : CVE-2015-2875

CVE.ORG link : CVE-2015-2875


JSON object : View

Products Affected

lacie

  • lac9000464u_firmware
  • lac9000464u
  • lac9000436u_firmware
  • lac9000436u

seagate

  • wireless_plus_mobile_storage
  • wireless_mobile_storage
  • goflex_sattelite
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')