Fiddler Everywhere flaw lets a crafted SAZ file run backend commands
Opening a malicious file can let attackers touch files on your PC.
Summary
The sessions grid in Fiddler Everywhere does not properly neutralize input, so an attacker can run internal commands on the PC of a user who opens a malicious SAZ file. Version 8.3.0 and earlier are affected.
Affected when
- the user opens a specially crafted SAZ file
What to do
Update to 8.4.0 or later. Until then, do not open SAZ files from untrusted sources.
Products and platforms
CVE IDs
Sources
- Advisory: telerik.com (opens in a new tab)
Times
First published
First seen