Directory Traversal Vulnerability in Psensor Package
Summary
UBUNTU-CVE-2014-10073: The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory. Affects psensor versions 1.1.3-2ubuntu2 – 1.1.3-2ubuntu3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Psensor is a graphical monitoring tool for temperature sensors, allowing users to visualize and manage temperature readings from various sources. It is widely used in server environments to ensure optimal operating conditions. However, versions prior to 1.1.4 are susceptible to a directory traversal vulnerability, which can expose sensitive files to unauthorized access.
Vulnerability Detail
The vulnerability arises from the create_response function in server/server.c of Psensor versions before 1.1.4. It lacks proper validation to ensure that requested files are confined within the webserver directory. This oversight allows attackers to exploit the system by accessing files outside the intended directory, potentially leading to exposure of sensitive information. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the webserver directory by adjusting file permissions or using firewall rules to limit access to the Psensor web interface. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The directory traversal vulnerability in Psensor poses a significant risk to users running versions prior to 1.1.4. It is crucial to update to the latest version to safeguard against potential unauthorized access to sensitive files. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for psensor →
FAQ
A directory traversal vulnerability allows attackers to access files and directories stored outside the intended directory, potentially exposing sensitive information.
You can check your version of Psensor by running the command 'psensor --version' in the terminal. If it is below 1.1.4, it is affected by this vulnerability.
If exploited, this vulnerability could allow unauthorized users to access sensitive files on the server, leading to data breaches or system compromise.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability by simply uploading your manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for psensor.
