Medium severity4.3NVD Advisory· Published Jul 28, 2020· Updated Jun 17, 2026
CVE-2020-15712
CVE-2020-15712
Description
rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByPath.php script containing hexadecimal encoded "dot dot" sequences (%2f..%2f) in the path parameter to view arbitrary files on the system.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- rConfig/rConfigdescription
Patches
Vulnerability mechanics
References
2- www.rconfig.com/downloads/v3-release-notesnvdRelease NotesVendor Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/184938nvdVDB Entry
News mentions
0No linked articles in our index yet.