WaveStore WaveView Client Path Traversal Vulnerability Allowing Arbitrary File Access on WaveStore Server

A path traversal vulnerability has been identified in the WaveView client, which allows high-privileged users to read or delete any file on the connected WaveStore Server. This issue arises in the 'ilog' script, which is executed with root privileges. The vulnerability affects all versions of WaveStore Server prior to 6.44.44.

Impact

Exploitation of this vulnerability could lead to unauthorized reading or deletion of files on the WaveStore Server, with the potential for significant disruption depending on the nature of the files accessed or removed.

Remediation

Users can upgrade to WaveStore Server version 6.44.44 or later to address this vulnerability.