CVE-2023-4480

Katalog CVE

CVSS 5.5 · Medium EPSS 0,68%

Kerentanan Insertion of Sensitive Information into Externally-Accessible File or Directory pada php-fusion phpfusion. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation. 

Rincian

Terbit di NVD

5 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-advisory-cve-2023-2453/ advisory pihak ketiga