CVE-2023-52288

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52288
An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resource-data/<file_path>.txt URI (from views.py), allows attackers to read arbitrary files.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sujeetkv:flaskcode:*:*:*:*:*:python:*:*
History

24 Jan 2024, 18:40

Type Values Removed Values Added
References () https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md - () https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md - Third Party Advisory
First Time Sujeetkv flaskcode
Sujeetkv
CWE CWE-22
CPE cpe:2.3:a:sujeetkv:flaskcode:*:*:*:*:*:python:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

14 Jan 2024, 21:42

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en flaskcode package hasta la versión 0.0.8 para Python. Un directory traversal no autenticado, explotable con una solicitud GET a un URI /resource-data/.txt (de views.py), permite a los atacantes leer archivos arbitrarios.

13 Jan 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-13 04:15

Updated : 2024-01-24 18:40

NVD link : CVE-2023-52288

Mitre link : CVE-2023-52288

CVE.ORG link : CVE-2023-52288

JSON object : View

Products Affected

sujeetkv

  • flaskcode
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')