Back to Database
Status published
Medium
CVE-2018-14573
A Local File Inclusion (LFI) vulnerability exists in the Web...
Vulnerability Description
A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API allows for the downloading of arbitrary files through the use of directory traversal sequences, aka CSL-1683.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-14573
Credits & Attribution
No credits recorded in the NVD database.
References
More from trms
View All →CVE-2019-13020
The fetch API in Tightrope Media Carousel before 7.1.3 has...
Critical
10
CVE-2018-18931
An issue was discovered in the Tightrope Media Carousel digital...
High
8.8
CVE-2018-18930
The Tightrope Media Carousel digital signage product 7.0.4.104 contains an...
High
8.8
CVE-2018-18929
The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is...
High
8.8
Affected Vendor
trms
View all reports →Affected Software
tightrope media carousel digital signage
Vulnerable Versions:
0
Timeline
Official Publish:
July 23rd, 2018
Last Modified:
September 17th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.