CVE-2023-4614
setThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de LG LED Assistant. No se requiere autenticación para explotar esta vulnerabilidad. El fallo específico existe dentro del endpoint /api/installation/setThumbnailRc. El problema se debe a la falta de validación adecuada de una ruta proporcionada por el usuario antes de utilizarla en operaciones de archivo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del usuario actual.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-08-30 CVE Reserved
- 2023-09-04 CVE Published
- 2024-09-30 CVE Updated
- 2024-10-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
- CAPEC-253: Remote Code Inclusion
References (2)
URL | Tag | Source |
---|---|---|
https://www.zerodayinitiative.com/advisories/ZDI-23-1222 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://lgsecurity.lge.com/bulletins/idproducts#updateDetails | 2023-09-08 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Lg Search vendor "Lg" | Lg Led Assistant Search vendor "Lg" for product "Lg Led Assistant" | 2.1.45 Search vendor "Lg" for product "Lg Led Assistant" and version "2.1.45" | - |
Affected
|