Lucene search
HistoryJul 12, 2023 - 9:15 p.m.
CVE-2023-26564
syncfusion ej2
aspcore
file provider
directory traversal
unauthenticated attacker
file download
file upload
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
61.6%
The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server.
Affected configurations
Node
syncfusionej2_aspcore_file_providerMatch-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| syncfusion | ej2_aspcore_file_provider | - | cpe:2.3:a:syncfusion:ej2_aspcore_file_provider:-:*:*:*:*:*:*:* |
Related
prion
prion
Directory traversal
2023-07-12 21:15:00
cve
cve
CVE-2023-26564
2023-07-12 21:15:09
cvelist
cvelist
CVE-2023-26564
2023-07-12 00:00:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
61.6%
Related for NVD:CVE-2023-26564