CVE-2022-46154

2022-12-0619:15:10

CWE-22

[email protected]

web.nvd.nist.gov

kodexplorer

cve-2022-46154

file manager

web security

code editor

unauthorized access

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

52.4%

JSON

Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.

Affected configurations

Vulners

NVD

Node

kalcaddlekodexplorerRange<4.50

CPENameOperatorVersion
kodcloud:kodexplorerkodcloud kodexplorerlt4.50

CPE	Name	Operator	Version
kodcloud:kodexplorer	kodcloud kodexplorer	lt	4.50

CNA Affected

[
  {
    "vendor": "kalcaddle",
    "product": "KodExplorer",
    "versions": [
      {
        "version": "< 4.50",
        "status": "affected"
      }
    ]
  }
]