CVE-2023-3239 : A vulnerability, which was classified as problematic, was found in OTCMS up to 6

A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.

Published 2023-06-14 09:15:09

Updated 2024-05-17 02:27:23

Source VulDB

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2023-3239

Otcms » Otcms
Versions up to, including, (<=) 6.62
cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-3239

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-3239

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
2.7	LOW	AV:A/AC:L/Au:S/C:P/I:N/A:N	5.1	2.9	VulDB
Access Vector: Adjacent Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
3.5	LOW	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.1	1.4	VulDB
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
3.5	LOW	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.1	1.4	VulDB	2024-02-13
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-3239

CWE-24 Path Traversal: '../filedir'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2023-3239

https://vuldb.com/?id.231510

CVE-2023-3239: OTCMS path traversal
Third Party Advisory
https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md

HuBenVulList/OTCMS was discovered obtain the web directory path and other information leaked .md at main · HuBenLab/HuBenVulList · GitHub
Exploit
https://vuldb.com/?ctiid.231510

CVE-2023-3239: OTCMS path traversal
Permissions Required;Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-3239

Products affected by CVE-2023-3239

Exploit prediction scoring system (EPSS) score for CVE-2023-3239

CVSS scores for CVE-2023-3239

CWE ids for CVE-2023-3239

References for CVE-2023-3239