Lucene search

K
cve[email protected]CVE-2023-2453
HistorySep 05, 2023 - 3:15 p.m.

CVE-2023-2453

2023-09-0515:15:42
CWE-829
web.nvd.nist.gov
16
cve-2023-2453
insufficient sanitization
file names
arbitrary file execution
phpfusion
nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a ‘.php’ file payload.

Affected configurations

NVD
Node
php-fusionphpfusionRange9.10.30

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "PHPFusion",
    "repo": "https://github.com/PHPFusion/PHPFusion",
    "vendor": "PHPFusion",
    "versions": [
      {
        "lessThanOrEqual": "9.10.30",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

Related for CVE-2023-2453