ReQuest Serious Play Media Player 3.0 File Disclosure / Path Traversal

Posted on 19 October 2020

ReQuest Serious Play Media Player version 3.0 suffers from an unauthenticated file disclosure vulnerability when input passed through the file parameter in tail.html and file.html script is not properly verified before being used to read web log files. This can be exploited to disclose contents of files from local resources.