Exploit

CVE-2023-2984

Path Traversal: '\..\filename' (CWE-29)

Published: May 30, 2023 / Updated: 17mo ago

A path traversal vulnerability exists in the CMS, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.

A path traversal vulnerability exists in the CMS, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.

CVE Id : CVE-2023-2984 Published Date: 2023-06-05T18:16:00+00:00 Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. inTheWild added a link to an exploit: https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191

Pimcore could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user requests by the filename endpoint. Everyone that supports the site helps enable new functionality.

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.