AxxonSoft Axxon Next Directory Traversal
CVE-2018-7467
Affected: AxxonSoft Axxon Next; the public CVE record does not identify a version range. Severity: CVSS v3.0 7.5 High (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); CVSS v2 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N). Weakness: CWE-22, Path Traversal.
Reporter: Project X IT security research. No public vendor advisory or fixed-version statement is identified in the cited CVE records; affected customers should obtain current remediation guidance directly from AxxonSoft.
AxxonSoft Axxon Next was affected by a client directory traversal issue using an initial /css//..%2f substring in a URI.
Security consequence
Directory traversal flaws can allow a remote user to escape the intended content directory and request files that the application was not designed to expose. Canonicalize paths, constrain access to an explicit root, reject traversal sequences after decoding, and authorize the requested resource server-side.