Vulnerability Details : CVE-2023-5022
A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_templets_post.php. The manipulation of the argument activepath leads to absolute path traversal. The associated identifier of this vulnerability is VDB-239863.
Vulnerability category: Directory traversal
Products affected by CVE-2023-5022
- cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-5022
0.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 62 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-5022
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.2
|
MEDIUM | AV:A/AC:L/Au:S/C:P/I:P/A:P |
5.1
|
6.4
|
VulDB | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
2.1
|
3.4
|
VulDB | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
2.1
|
3.4
|
VulDB | 2024-02-13 |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2023-5022
-
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.Assigned by: cna@vuldb.com (Primary)
References for CVE-2023-5022
-
https://github.com/bayuncao/DEDEcms
GitHub - bayuncao/DEDEcmsThird Party Advisory
-
https://vuldb.com/?id.239863
CVE-2023-5022: DedeCMS select_templets_post.php absolute path traversalThird Party Advisory
-
https://vuldb.com/?ctiid.239863
CVE-2023-5022: DedeCMS select_templets_post.php absolute path traversalThird Party Advisory
Jump to