CVE-2023-4480
Assigner: SNPS
Published: 2023-09-05T14:43:25.762Z
State: PUBLISHED
affected: defaultStatus: affected
product: PHPFusion
repo: https://github.com/PHPFusion/PHPFusion
vendor: PHPFusion
versions: lessThanOrEqual: 9.10.30
status: affected
version: 0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Dharani Sri Penumacha
datePublic: 2023-09-05T14:30:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.</span><span style="background-color: rgb(255, 255, 255);">&nbsp;</span>


value: 
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation. 


impacts: capecId: CAPEC-126
descriptions: value: CAPEC-126 Path Traversal
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-538
description: CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
type: CWE
source: discovery: EXTERNAL
title: Arbitrary File Read in Fusion File Manager
workarounds: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Technologies such as a web application firewall may help to mitigate exploitation attempts.</span>

<br>
value: 
Technologies such as a web application firewall may help to mitigate exploitation attempts.



x_generator: engine: Vulnogram 0.1.0-dev