An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a, 11.4 |
Updated product to Biztalk360, affected versions to 11.4, severity to CRITICAL, marked as actively exploited, and provided patch version 11.5.
Initial creation
