CVE-2014-2575

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-06-06 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.

Affected products

DevExpress Aspxfilemanager Control For Webforms And Mvc: through 13.1.9; 10.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.8 (+55)

References

http://osvdb.org/show/osvdb/107742
http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2.8-Directory-Traversal.html
http://seclists.org/fulldisclosure/2014/Jun/24
http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2
http://www.exploit-db.com/exploits/33700
http://www.securityfocus.com/archive/1/532304/100/0/threaded
http://www.securityfocus.com/bid/67902
https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-006/-directory-traversal-in-devexpress-asp-net-file-manager
http://osvdb.org/show/osvdb/107742
http://packetstormsecurity.com/files/126953/DevExpress-ASP.NET-File-Manager-13.2.8-Directory-Traversal.html
http://seclists.org/fulldisclosure/2014/Jun/24
http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2

Get alerted when CVE-2014-2575 or the next vulnerability affects your stack