CVE-2023-4480
Arbitrary File Read in Fusion File Manager
- State
- Published
- Severity
- 5.5 Medium
- Published
- Sep 5, 2023
- Updated
- Sep 26, 2024
- Reserved
- Aug 22, 2023
Description
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N | SNPS |
Weaknesses
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected Products
| Product | Versions |
|---|---|
PHPFusionPHPFusion |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.