by Kastro
Paper/Archive/CVE-2023-6900

CVE-2023-6900

rmountjoy92 DashMachine — rmountjoy92 DashMachine delete_file path traversal

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 64.8.648 × 2013.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the file /settings/delete_file. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-248258 is the identifier assigned to this vulnerability.

Affected

ProductAffectedFixed inSource
DashMachine0.5-4–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
VulDB (CNA)4.6CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
VulDB (CNA)4.6CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

writeupvuldb.com/?id.248258refvuldb.com/?ctiid.248258exploittreasure-blarney-085.notion.site/DashMachine-Arbitrary-File-Deletion-ab44f2fe68e843c393ae9e0c1d487676