CVE-2014-2352

{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DataHub", "vendor": "Cogent", "versions": [{"lessThan": "7.3.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Alain Homewood"}], "datePublic": "2014-05-29T06:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>\n\nThe directory specifier can include designators that can be used to \ntraverse the directory path. Exploiting this vulnerability may enable an\n attacker to access a limited number of hardcoded file types. Further \nexploitation of this vulnerability may allow an attacker to cause the \nweb server component to enter a denial-of-service condition.\n\n</p>"}], "value": "The directory specifier can include designators that can be used to \ntraverse the directory path. Exploiting this vulnerability may enable an\n attacker to access a limited number of hardcoded file types. Further \nexploitation of this vulnerability may allow an attacker to cause the \nweb server component to enter a denial-of-service condition."}], "metrics": [{"cvssV2_0": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 7.8, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-10-03T16:31:41.797Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02"}, {"url": "http://cogentdatahub.com/Download_Software.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Cogent Real-Time Systems, Inc. has produced a new version of the \nCogent DataHub application, Version 7.3.5, that fixes three of the four \nidentified vulnerabilities. The updated version is available at the \nfollowing address:</p>\n<p><a target=\"_blank\" rel=\"nofollow\" href=\"http://cogentdatahub.com/Download_Software.html\">http://cogentdatahub.com/Download_Software.html</a></p>Cogent\n has indicated that it will not be fixing the cryptographic weaknesses \nof hashed usernames and passwords because of compatibility issues with \nexisting systems. Cogent and the researcher agree that an effective \nmitigation strategy for users is to select sufficiently strong \npasswords. Cogent has indicated that password hashes can be checked for \nstrength using sites such as: <a target=\"_blank\" rel=\"nofollow\" href=\"https://crackstation.net/\">https://crackstation.net/</a>.\n\n<br>"}], "value": "Cogent Real-Time Systems, Inc. has produced a new version of the \nCogent DataHub application, Version 7.3.5, that fixes three of the four \nidentified vulnerabilities. The updated version is available at the \nfollowing address:\n\n\n http://cogentdatahub.com/Download_Software.html \n\nCogent\n has indicated that it will not be fixing the cryptographic weaknesses \nof hashed usernames and passwords because of compatibility issues with \nexisting systems. Cogent and the researcher agree that an effective \nmitigation strategy for users is to select sufficiently strong \npasswords. Cogent has indicated that password hashes can be checked for \nstrength using sites such as: https://crackstation.net/ ."}], "source": {"advisory": "ICSA-14-149-02", "discovery": "EXTERNAL"}, "title": "Cogent DataHub Path Traversal", "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2014-2352", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to read arbitrary files of unspecified types, or cause a web-server denial of service, via a crafted pathname."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02", "refsource": "MISC", "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T10:14:25.305Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2014-2352", "datePublished": "2014-05-30T23:00:00.000Z", "dateReserved": "2014-03-13T00:00:00.000Z", "dateUpdated": "2025-10-03T16:31:41.797Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DataHub", "vendor": "Cogent", "versions": [{"lessThan": "7.3.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A416FED-E221-48CE-8AFB-D822C6C8E4FF", "versionEndIncluding": "7.3.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "D2DE7A08-D283-4EB3-BAAE-0BA4A8C2E088", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "66059E64-6EB2-4F9D-BCB3-099A01C9E72A", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "F05AAB16-437D-4A4E-892B-9B83E47FEC24", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "65D16B36-567F-499D-AC7B-D2CC85AD9327", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1.63:*:*:*:*:*:*:*", "matchCriteriaId": "D8EC08FD-5473-4DB6-9828-8D007FE1E5FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "F2724B2F-49B9-4423-A8D5-95B1E81DDEF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "C414FB06-9100-4BB9-9F5C-A31946C11E84", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "D881278E-D6B8-4147-91BA-4EBE049B0C70", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "3142AD5D-E5E1-447B-8FCD-444A31D62437", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "321C4D3C-67FF-4284-A569-8359B58FC2FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "0B5C1FCA-D64E-4C12-B3A4-4200F95C6315", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The directory specifier can include designators that can be used to \ntraverse the directory path. Exploiting this vulnerability may enable an\n attacker to access a limited number of hardcoded file types. Further \nexploitation of this vulnerability may allow an attacker to cause the \nweb server component to enter a denial-of-service condition."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en Cogent DataHub anterior a 7.3.5 permite a atacantes remotos leer archivos arbitrarios de tipos no especificados, o causar una denegaci\u00f3n de servicio de servidor web, a trav\u00e9s de un nombre de ruta manipulado."}], "id": "CVE-2014-2352", "lastModified": "2026-06-17T00:06:27.733", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 7.8, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "ics-cert@hq.dhs.gov", "type": "Secondary", "userInteractionRequired": false}, {"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-05-30T23:55:02.847", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "http://cogentdatahub.com/Download_Software.html"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{}