Hcl Appscan 360
Monthly
Path traversal in the ASReportService component of HCL AppScan 360° allows an authenticated user to supply manipulated file-path input and reach files outside the intended report directory, exposing the surrounding file-system structure or permitting modification of files within the application's directory scope. The flaw is network-reachable but requires a valid account and access to the ASReportService interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), which keeps practical risk moderate and well below the 6.3 base score. There is no public exploit identified at time of analysis and no confirmed active exploitation.
Path traversal in the ASReportService component of HCL AppScan 360° allows an authenticated user to supply manipulated file-path input and reach files outside the intended report directory, exposing the surrounding file-system structure or permitting modification of files within the application's directory scope. The flaw is network-reachable but requires a valid account and access to the ASReportService interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), which keeps practical risk moderate and well below the 6.3 base score. There is no public exploit identified at time of analysis and no confirmed active exploitation.