CVE-2023-49508

Опубликовано: 16 фев. 2024

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component.

Ссылки

https://github.com/YetiForceCompany/YetiForceCRM/commit/ba3a348aa6ecdf0a1d8b289cbb679bebcda7a132
Patch
https://github.com/c4v4r0n/Research/tree/main/CVE-2023-49508
Third Party Advisory
https://huntr.com/bounties/29ed641d-eb03-4532-aed4-f96e11f78983/
Permissions Required
https://github.com/YetiForceCompany/YetiForceCRM/commit/ba3a348aa6ecdf0a1d8b289cbb679bebcda7a132
Patch
https://github.com/c4v4r0n/Research/tree/main/CVE-2023-49508
Third Party Advisory
https://huntr.com/bounties/29ed641d-eb03-4532-aed4-f96e11f78983/
Permissions Required

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:yetiforce:yetiforce_customer_relationship_management:*:*:*:*:*:*:*:*

Версия до 6.5.0 (исключая)

EPSS

Процентиль: 35%

0.00147

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-394m-vxwj-363j