CVE-2019-10767

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enabled (by default isn't enabled).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	iobroker.js-controller	All versions prior to version 2.0.25

References

https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fdaPatch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881Exploit, Third Party Advisory
https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fdaPatch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881Exploit, Third Party Advisory

Timeline

Published: Nov 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107687.5In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto CVE-2019-107699.8safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulner CVE-2019-10775.0An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studi CVE-2019-107706.1All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects th CVE-2019-107716.1Characters in the GET url path are not properly escaped and can be reflected in the server response.CVE-2019-107726.1It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by CVE-2019-107737.8In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specia CVE-2019-107749.8php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code executio CVE-2019-107757.5ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.CVE-2019-107769.8In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-dif CVE-2019-107779.8In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function wi CVE-2019-107789.8devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The var