CVE-2023-40517 LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability

🗓️ 03 May 2024 02:11:42Reported by zdiType

LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getObject method implemented in the ContentRestController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2023-40517	3 May 202403:15	–	attackerkb
CNNVD	LG Simple Editor 安全漏洞	3 May 202400:00	–	cnnvd
CNVD	LG Simple Editor Information Disclosure Vulnerability (CNVD-2024-34033)	19 Jul 202400:00	–	cnvd
CVE	CVE-2023-40517	3 May 202402:11	–	cve
EUVD	EUVD-2023-45088	3 Oct 202520:07	–	euvd
NVD	CVE-2023-40517	3 May 202403:15	–	nvd
OSV	CVE-2023-40517	3 May 202403:15	–	osv
Positive Technologies	PT-2023-27495 · Lg · Lg Supersign Media Editor	24 Aug 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-40517 LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability	3 May 202402:11	–	vulnrichment
Zero Day Initiative	(0Day) LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability	24 Aug 202300:00	–	zdi

[
  {
    "vendor": "LG",
    "product": "SuperSign Media Editor",
    "versions": [
      {
        "version": "3.11.3_20171108",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-1219/

03 May 2024 02:11Current

7.4High risk

Vulners AI Score7.4

CVSS 37.5

EPSS0.0125

CWE-22