Vulnerability: Bonita BPM Portal <6.5.3 - Local File Inclusion

Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.

Impact

An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.

Severity

medium

Verified

Unknown