Lucene search

GitHub_MCVELIST:CVE-2022-46154

HistoryDec 06, 2022 - 6:08 p.m.

CVE-2022-46154 Arbitrary file access in KodExplorer

2022-12-0618:08:27

CWE-22

GitHub_M

www.cve.org

kodexplorer

arbitrary file access

upgrade

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

52.4%

JSON

Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.

CNA Affected

[
  {
    "vendor": "kalcaddle",
    "product": "KodExplorer",
    "versions": [
      {
        "version": "< 4.50",
        "status": "affected"
      }
    ]
  }
]

References

github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98c

github.com/kalcaddle/KodExplorer/security/advisories/GHSA-6f8p-4w5q-j5j2

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

52.4%

JSON

Related for CVELIST:CVE-2022-46154