CVE-2019-10257

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-19 · updated 2026-06-17
Weakness: CWE-22

Description

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java sources from /WEB-INF/classes/*.class

Affected products

Zucchetti Hr Portal: through 2019-03-15

References

http://www.sk-it.com/en/cve.html
http://www.sk-it.com/en/cve.html

Get alerted when CVE-2019-10257 or the next vulnerability affects your stack