CVE-2018-19753

Vulnerability

Tarantella Enterprise versions prior to 3.11 are vulnerable to a directory traversal attack. The vulnerability exists in the application's handling of file paths, allowing an attacker to traverse directories and access files outside the intended root. [1]

Exploitation

An attacker can exploit this vulnerability by sending specially crafted HTTP requests containing path traversal sequences (such as ../) to the Tarantella Enterprise server. No authentication is required, as the attack can be performed remotely over the network. [1]

Impact

Successful exploitation allows an attacker to read arbitrary files on the server, including sensitive configuration files, credentials, or other confidential data. This can lead to further compromise of the system. [1]

Mitigation

The vulnerability is fixed in Tarantella Enterprise version 3.11 and later. Users should upgrade to this version or newer. If upgrading is not immediately possible, it is recommended to restrict network access to the Tarantella server and implement strict input validation. [1]