// For flags

CVE-2023-4480

Arbitrary File Read in Fusion File Manager

Severity Score

5.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.

Debido a una dependencia desactualizada en el componente "Fusion File Manager" accesible a través del panel de administración, un atacante puede enviar una petición crafteada que le permita leer el contenido de archivos del sistema accesibles dentro de los privilegios del proceso en ejecución. Además, pueden escribir archivos en ubicaciones arbitrarias, siempre que los archivos pasen la validación de extensión de archivo y el mime-type de la aplicación.

*Credits: Dharani Sri Penumacha
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-08-22 CVE Reserved
  • 2023-09-05 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-09-11 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
CAPEC
  • CAPEC-126: Path Traversal
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php-fusion
Search vendor "Php-fusion"
 Phpfusion
Search vendor "Php-fusion" for product "Phpfusion"
 <= 9.10.30
Search vendor "Php-fusion" for product "Phpfusion" and version " <= 9.10.30"
-
Affected