Lucene search

ASUSTOR1CVE-2023-2909

HistoryMay 31, 2023 - 10:15 a.m.

CVE-2023-2909

2023-05-3110:15:09

CWE-22

ASUSTOR1

web.nvd.nist.gov

cve-2023-2909

ez sync service

directory traversal

file deletion

security vulnerability

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

52.2%

JSON

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

Affected configurations

Nvd

Node

asustoradmRange4.0.0–4.0.6.reg2

asustoradmRange4.1.0–4.1.0rlq1

asustoradmRange4.2.0–4.2.1.rge2

VendorProductVersionCPE
asustoradm*cpe:2.3:a:asustor:adm:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
asustor	adm	*	cpe:2.3:a:asustor:adm::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "packageName": "EZ Sync",
    "platforms": [
      "Linux",
      "x86",
      "ARM",
      "64 bit"
    ],
    "product": "ADM",
    "vendor": "ASUSTOR",
    "versions": [
      {
        "lessThanOrEqual": "4.0.6.REG2",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.1.0.RLQ1",
        "status": "affected",
        "version": "4.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.1.RGE2",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      }
    ]
  }
]

References

www.asustor.com/security/security_advisory_detail?id=25

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

52.2%

JSON

Related for CVE-2023-2909