CVE-2023-3240

Опубликовано: 14 июн. 2023

Источник: nvd

CVSS3: 3.5

CVSS3: 6.5

CVSS2: 2.7

EPSS Низкий

Описание

A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.

Ссылки

https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md
Exploit
https://vuldb.com/?ctiid.231511
Permissions Required
Third Party Advisory
https://vuldb.com/?id.231511
Third Party Advisory
https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md
Exploit
https://vuldb.com/?ctiid.231511
Permissions Required
Third Party Advisory
https://vuldb.com/?id.231511
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*

Версия до 6.62 (включая)

EPSS

Процентиль: 30%

0.00109

Низкий

3.5 Low

CVSS3

6.5 Medium

CVSS3

2.7 Low

CVSS2

Дефекты

CWE-24

Связанные уязвимости

GHSA-w6pp-pqv8-v26m

CVSS3: 3.5

github

больше 2 лет назад

EPSS

Процентиль: 30%

0.00109

Низкий

3.5 Low

CVSS3

6.5 Medium

CVSS3

2.7 Low

CVSS2

Дефекты

CWE-24