Lucene search

[email protected]CVE-2023-2909

HistoryMay 31, 2023 - 10:15 a.m.

CVE-2023-2909

2023-05-3110:15:09

CWE-22

[email protected]

web.nvd.nist.gov

cve-2023-2909

ez sync service

directory traversal

file deletion

security vulnerability

nvd

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.2%

JSON

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

Affected configurations

NVD

Node

asustoradmRange4.0.0–4.0.6.reg2

asustoradmRange4.1.0–4.1.0rlq1

asustoradmRange4.2.0–4.2.1.rge2

CPENameOperatorVersion
asustor:admasustor admle4.0.6.reg2
asustor:admasustor admle4.1.0rlq1
asustor:admasustor admle4.2.1.rge2

CPE	Name	Operator	Version
asustor:adm	asustor adm	le	4.0.6.reg2
asustor:adm	asustor adm	le	4.1.0rlq1
asustor:adm	asustor adm	le	4.2.1.rge2

CNA Affected

[
  {
    "defaultStatus": "affected",
    "packageName": "EZ Sync",
    "platforms": [
      "Linux",
      "x86",
      "ARM",
      "64 bit"
    ],
    "product": "ADM",
    "vendor": "ASUSTOR",
    "versions": [
      {
        "lessThanOrEqual": "4.0.6.REG2",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.1.0.RLQ1",
        "status": "affected",
        "version": "4.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1.RGE2",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      }
    ]
  }
]

References

www.asustor.com/security/security_advisory_detail?id=25

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.2%

JSON

Related for CVE-2023-2909

prion1 cvelist1 nvd1