Lucene search

ASUSTOR1CVELIST:CVE-2023-2909

HistoryMay 31, 2023 - 9:26 a.m.

CVE-2023-2909 A Directory traversal vulnerability was found on EZ Sync service of ADM

2023-05-3109:26:31

CWE-22

ASUSTOR1

www.cve.org

directory traversal

ez sync service

adm

vulnerability

cve-2023-2909

security

8.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.2%

JSON

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "packageName": "EZ Sync",
    "platforms": [
      "Linux",
      "x86",
      "ARM",
      "64 bit"
    ],
    "product": "ADM",
    "vendor": "ASUSTOR",
    "versions": [
      {
        "lessThanOrEqual": "4.0.6.REG2",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.1.0.RLQ1",
        "status": "affected",
        "version": "4.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1.RGE2",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      }
    ]
  }
]

References

www.asustor.com/security/security_advisory_detail?id=25

8.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.2%

JSON

Related for CVELIST:CVE-2023-2909