Skip to content

Path traversal via unauthenticated endpoint.

Moderate
0x41c published GHSA-ffp9-rhfm-98c2 Oct 30, 2023

Package

packages/web/status/getfiles.php (PHP)

Affected versions

< 1.5.10

Patched versions

1.5.10

Description

Impact

An endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that are visible to the Apache user group.

Patches

Patched in commit 68d73740d7d40aee77cfda3fb8199d58bf04f48b, and 1.5.10.

Severity

Moderate
5.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CVE ID

CVE-2023-46237

Weaknesses

Credits