CVE-2023-6577
Byzoro PatrolFlow 2530Pro mailsendview.php path traversal
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file /log/mailsendview.php. The manipulation of the argument file with the input /boot/phpConfig/tb_admin.txt leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Una vulnerabilidad fue encontrada en Beijing Baichuo PatrolFlow 2530Pro hasta 20231126 y ha sido calificada como problemática. Este problema afecta un procesamiento desconocido del archivo /log/mailsendview.php. La manipulación del archivo de argumentos con la entrada /boot/phpConfig/tb_admin.txt conduce a un path traversal. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. A esta vulnerabilidad se le asignó el identificador VDB-247157. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.
Eine Schwachstelle wurde in Byzoro PatrolFlow 2530Pro bis 20231126 ausgemacht. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei /log/mailsendview.php. Durch das Beeinflussen des Arguments file mit der Eingabe /boot/phpConfig/tb_admin.txt mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-12-07 CVE Reserved
- 2023-12-07 CVE Published
- 2024-04-10 EPSS Updated
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://vuldb.com/?id.247157 | Technical Description | |
https://vuldb.com/?submit.243584 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/kpz-wm/cve/blob/main/Any_file_read.md | 2024-08-02 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Byzoro Search vendor "Byzoro" | Patrolflow-am-2530pro Firmware Search vendor "Byzoro" for product "Patrolflow-am-2530pro Firmware" | <= 2023-11-26 Search vendor "Byzoro" for product "Patrolflow-am-2530pro Firmware" and version " <= 2023-11-26" | - |
Affected
| in | Byzoro Search vendor "Byzoro" | Patrolflow-am-2530pro Search vendor "Byzoro" for product "Patrolflow-am-2530pro" | - | - |
Safe
|