One of the security holes, CVE-2017-9368, is related to a file server API that is designed for uploading and downloading files. Sending specially crafted HTTP GET requests to this API allows an unauthenticated attacker to view the file server’s source code.

Read full news article on SecurityWeek