deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46232
Published: 2023-10-25
Description: era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. `String[4096]`. Upgrading and redeploying affected contracts is the only way of working around the issue.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-471
References: https://github.com/matter-labs/era-compiler-vyper/commit/8be305a1b9c68d0fd47dad3434224ed85944ca25; https://github.com/matter-labs/era-compiler-vyper/security/advisories/GHSA-h8jv-969m-94r4; https://github.com/matter-labs/era-system-contracts/blob/main/contracts/ImmutableSimulator.sol#L37
CVE: CVE-2023-46583
Published: 2023-10-25
Description: Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbitrary code via a crafted payload injected into the State field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rumble773/sec-research/blob/main/NiV/CVE-2023-46583.md; https://github.com/rumble773/sec-research/blob/main/NiV/CVE-2023-46583.md
CVE: CVE-2023-46584
Published: 2023-10-25
Description: SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate privileges via a crafted request to the new-user-testing.php endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/rumble773/sec-research/blob/main/NiV/CVE-2023-46584.md; https://github.com/rumble773/sec-research/blob/main/NiV/CVE-2023-46584.md
CVE: CVE-2023-30967
Published: 2023-10-26
Description: Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system. 
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-287, CWE-22
References: https://palantir.safebase.us/?tcuUid=8fd5809f-26f8-406e-b36f-4a6596a19d79; https://palantir.safebase.us/?tcuUid=8fd5809f-26f8-406e-b36f-4a6596a19d79
CVE: CVE-2023-30969
Published: 2023-10-26
Description: The Palantir Tiles1 service was  found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.


CVSS Score: 8.2 (HIGH)
CWE: CWE-284, CWE-862
References: https://palantir.safebase.us/?tcuUid=afcbc9b2-de62-44b9-b28b-2ebf0684fbf7; https://palantir.safebase.us/?tcuUid=afcbc9b2-de62-44b9-b28b-2ebf0684fbf7
CVE: CVE-2023-43905
Published: 2023-10-26
Description: Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://github.com/Playful-CR/CVE-paddle-/blob/main/CVE-2023-43905..md; https://github.com/Playful-CR/CVE-paddle-/blob/main/CVE-2023-43905..md
CVE: CVE-2023-43906
Published: 2023-10-26
Description: Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Playful-CR/CVE-paddle-/blob/main/CVE-2023-43906; https://github.com/Playful-CR/CVE-paddle-/blob/main/CVE-2023-43906
CVE: CVE-2023-46345
Published: 2023-10-26
Description: Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://gist.github.com/rycbar77/d747b2c37b544ece30b2353a65ab41f9; https://gist.github.com/rycbar77/d747b2c37b544ece30b2353a65ab41f9
CVE: CVE-2023-46668
Published: 2023-10-26
Description: If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203; https://www.elastic.co/community/security; https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203
CVE: CVE-2023-46667
Published: 2023-10-26
Description: An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.
CVSS Score: 8.1 (HIGH)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737; https://www.elastic.co/community/security; https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737
CVE: CVE-2023-31422
Published: 2023-10-26
Description: An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana_system, kibana-metricbeat, or Kibana end-users.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287; https://www.elastic.co/community/security; https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287
CVE: CVE-2023-31421
Published: 2023-10-26
Description: It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://discuss.elastic.co/t/beats-elastic-agent-apm-server-and-fleet-server-8-10-1-security-update-improper-certificate-validation-issue-esa-2023-16/343385; https://www.elastic.co/community/security; https://discuss.elastic.co/t/beats-elastic-agent-apm-server-and-fleet-server-8-10-1-security-update-improper-certificate-validation-issue-esa-2023-16/343385
CVE: CVE-2023-46752
Published: 2023-10-26
Description: An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.
CVSS Score: 5.9 (MEDIUM)
References: https://github.com/FRRouting/frr/pull/14645/commits/b08afc81c60607a4f736f418f2e3eb06087f1a35; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html; https://github.com/FRRouting/frr/pull/14645/commits/b08afc81c60607a4f736f418f2e3eb06087f1a35
CVE: CVE-2023-46753
Published: 2023-10-26
Description: An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-863
References: https://github.com/FRRouting/frr/pull/14645/commits/d8482bf011cb2b173e85b65b4bf3d5061250cdb9; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html; https://github.com/FRRouting/frr/pull/14645/commits/d8482bf011cb2b173e85b65b4bf3d5061250cdb9
CVE: CVE-2023-46754
Published: 2023-10-26
Description: The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/obl-ong/admin/releases/tag/v1.1.2; https://github.com/obl-ong/admin/releases/tag/v1.1.2
CVE: CVE-2023-5139
Published: 2023-10-26
Description: Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120, CWE-120
References: http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2023/Nov/1; http://www.openwall.com/lists/oss-security/2023/11/07/1
CVE: CVE-2023-5798
Published: 2023-10-26
Description: The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_get(), which could allow users with a role as low as Editor to perform SSRF attacks
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/bbb4c98c-4dd7-421e-9666-98f15acde761; https://wpscan.com/vulnerability/bbb4c98c-4dd7-421e-9666-98f15acde761
CVE: CVE-2023-30492
Published: 2023-10-26
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vark Minimum Purchase for WooCommerce plugin <= 2.0.0.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/minimum-purchase-for-woocommerce/wordpress-minimum-purchase-for-woocommerce-plugin-2-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/minimum-purchase-for-woocommerce/wordpress-minimum-purchase-for-woocommerce-plugin-2-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46072
Published: 2023-10-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/add-actions-and-filters/wordpress-add-shortcodes-actions-and-filters-plugin-2-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/add-actions-and-filters/wordpress-add-shortcodes-actions-and-filters-plugin-2-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46074
Published: 2023-10-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Borbis Media FreshMail For WordPress plugin <= 2.3.2 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/freshmail-integration/wordpress-freshmail-for-wordpress-plugin-2-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/freshmail-integration/wordpress-freshmail-for-wordpress-plugin-2-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5802
Published: 2023-10-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-knowledgebase/wordpress-wp-knowledgebase-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-knowledgebase/wordpress-wp-knowledgebase-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2020-17477
Published: 2023-10-26
Description: Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators to read LDAP password hashes (sambaNTPassword, krb5Key, sambaPasswordHistory, and pwhistory) via LDAP search requests. For example, a teacher can gain administrator access via an NTLM hash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://forge.univention.org/bugzilla/show_bug.cgi?id=50669; https://forge.univention.org/bugzilla/show_bug.cgi?id=50669
CVE: CVE-2023-32116
Published: 2023-10-26
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin <= 4.0.12 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-post-types/wordpress-custom-post-types-plugin-4-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-post-types/wordpress-custom-post-types-plugin-4-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46075
Published: 2023-10-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contact-forms-builder/wordpress-contact-form-builder-contact-widget-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-forms-builder/wordpress-contact-form-builder-contact-widget-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46076
Published: 2023-10-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.102 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-pdf-invoice-builder/wordpress-woocommerce-pdf-invoice-builder-plugin-1-2-100-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-pdf-invoice-builder/wordpress-woocommerce-pdf-invoice-builder-plugin-1-2-100-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46077
Published: 2023-10-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-facebook-feed/wordpress-the-awesome-feed-custom-feed-plugin-2-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-facebook-feed/wordpress-the-awesome-feed-custom-feed-plugin-2-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46081
Published: 2023-10-26
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/lava-directory-manager/wordpress-lava-directory-manager-plugin-1-1-34-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lava-directory-manager/wordpress-lava-directory-manager-plugin-1-1-34-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46088
Published: 2023-10-26
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-full-stripe-free/wordpress-wp-full-stripe-free-plugin-1-6-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/wp-full-stripe-free/wordpress-wp-full-stripe-free-plugin-1-6-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-46094
Published: 2023-10-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/enhanced-e-commerce-for-woocommerce-store/wordpress-conversios-io-plugin-6-5-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/enhanced-e-commerce-for-woocommerce-store/wordpress-conversios-io-plugin-6-5-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5780
Published: 2023-10-26
Description: A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the file general/system/approve_center/flow_guide/flow_type/set_print/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243586 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/RCEraser/cve/blob/main/sql_inject_5.md; https://vuldb.com/?ctiid.243586; https://vuldb.com/?id.243586
CVE: CVE-2023-5781
Published: 2023-10-26
Description: A vulnerability, which was classified as critical, has been found in Tongda OA 2017 11.10. This issue affects the function DELETE_STR of the file general/system/res_manage/monitor/delete_webmail.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243587. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/wangxinyudad/cve/blob/main/sql.md; https://vuldb.com/?ctiid.243587; https://vuldb.com/?id.243587
CVE: CVE-2023-41095
Published: 2023-10-26
Description: Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash.
This issue affects Silicon Labs OpenThread SDK: 2.3.1 and earlier.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-312, CWE-311
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ZkKh7QAF?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ZkKh7QAF?operationContext=S1
CVE: CVE-2023-41096
Published: 2023-10-26
Description: Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules)
 allows potential modification or extraction of network credentials stored in flash.


This issue affects Silicon Labs Ember ZNet SDK: 7.3.1 and earlier.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-312, CWE-311
References: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ZkKh7QAF?operationContext=S1; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ZkKh7QAF?operationContext=S1
CVE: CVE-2023-46090
Published: 2023-10-26
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/spider-facebook/wordpress-wdsocialwidgets-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/spider-facebook/wordpress-wdsocialwidgets-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5782
Published: 2023-10-26
Description: A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /manage/delete_query.php of the component General News. The manipulation of the argument NEWS_ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243588. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Charmeeeeee/Tongda-OA-repo/blob/main/Tongda_OA_Vulnerability_Report.md; https://vuldb.com/?ctiid.243588; https://vuldb.com/?id.243588
CVE: CVE-2023-5783
Published: 2023-10-26
Description: A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/system/approve_center/flow_sort/flow/delete.php. The manipulation of the argument id/sort_parent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243589 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/halleyakina/cve/blob/main/sql.md; https://vuldb.com/?ctiid.243589; https://vuldb.com/?id.243589
CVE: CVE-2023-45867
Published: 2023-10-26
Description: ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web server. The attacker can access files that are readable by the web server user www-data; this may include sensitive configuration files and documents located outside the documentRoot. The vulnerability is exploited by an attacker who manipulates the file parameter in a URL, inserting directory traversal sequences in order to access unauthorized files. This manipulation allows the attacker to retrieve sensitive files, such as /etc/passwd, potentially compromising the system's security. This issue poses a significant risk to confidentiality and is remotely exploitable over the internet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://rehmeinfosec.de; https://rehmeinfosec.de/labor/cve-2023-45867; https://rehmeinfosec.de
CVE: CVE-2023-45868
Published: 2023-10-26
Description: The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can move specified directories, normally outside the documentRoot, to a publicly accessible location via the PHP function rename(). This results in a total loss of confidentiality, exposing sensitive resources, and potentially denying access to the affected component and the operating system's components. To exploit this, an attacker must manipulate a POST request during the creation of an exercise unit, by modifying the old_name and new_name parameters via directory traversal. However, it's essential to note that, when exploiting this vulnerability, the specified directory will be relocated from its original location, rendering all files obtained from there unavailable.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://rehmeinfosec.de; https://rehmeinfosec.de/labor/cve-2023-45867; https://rehmeinfosec.de