VULNERABILITY INTELLIGENCE

CVE-2018-14573

CVSS score5.5 MEDIUM
EPSS probability6.39%
CISA KEVNot currently listed
Published2018-07-23
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references