Path Traversal

2023-10-2406:26:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

http request

wagtail crx codered extensions

server

sensitive information

passwords

configuration files

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

32.4%

JSON

coderedcms is vulnerable to Path Traversal. An attacker could exploit this vulnerability by sending a specially crafted HTTP request to a vulnerable Wagtail CRX CodeRed Extensions server. The request would contain a specially crafted path that would cause the server to serve the attacker a file that is outside of the expected directory. This could allow the attacker to access sensitive information, such as passwords or configuration files.