Marvell QConvergeConsole Directory Traversal Information Disclosure Vulnerability

A directory traversal vulnerability allowing information disclosure has been identified in Marvell QConvergeConsole. This issue arises in the getFileUploadSize method, where user-supplied paths are not properly validated before being used in file operations. As a result, remote attackers can exploit this vulnerability to access sensitive information, with the exploitation occurring in the context of the SYSTEM user. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability leads to unauthorized information disclosure on the affected system.

Remediation

Marvell QConvergeConsole is no longer supported or recommended by the vendor. The product has reached End of Life and End of Support status after version 5.5.0.85 was released in January 2022.