CVE-2023-37474

Katalog CVE

CVSS 7.5 · High EPSS 44,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada 9001 copyparty. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

14 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

44,9% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff patch
• https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg exploit · advisory pihak ketiga
• http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html