CVE-2019-12276

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.html
https://github.com/grandnode/grandnodeThird Party Advisory
https://grandnode.comVendor Advisory
http://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.html
https://github.com/grandnode/grandnodeThird Party Advisory
https://grandnode.comVendor Advisory

Timeline

Published: Jun 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-122779.8Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for .. in a pathname.CVE-2019-122784.3Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mish CVE-2019-122799.8Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disp CVE-2019-12285.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully ex CVE-2019-122807.8PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.CVE-2019-122889.8An issue was discovered in upgrade_htmls.cgi on VStarcam 100T (C7824WIP) KR75.8.53.20 and 200V (C38S) KR203.18.1.20 devices. The web service CVE-2019-122899.8An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 CVE-2019-12298.8An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could lev CVE-2019-122907.5GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This m CVE-2019-122917.5HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a polic CVE-2019-122929.8Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.CVE-2019-122938.8In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights