WaveStore WaveView Client Path Traversal Vulnerability Allowing Arbitrary Command Execution on WaveStore Server

A path traversal vulnerability has been identified in the WaveView client, allowing high-privileged users to execute arbitrary operating system commands on the connected WaveStore Server. This issue arises in the 'showerr' script, where improper validation of file paths can be exploited. The vulnerability affects all versions of WaveStore Server prior to 6.44.44.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server, with potential for significant system compromise.

Remediation

Users can upgrade to WaveStore Server version 6.44.44 or later to address this vulnerability.