CVE-2023-35801
High
Description
A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, resulting in the unauthorized reading and writing of arbitrary files. Successful exploitation requires an attacker to have access to a user account with write privileges. FME Flow 2023.0 is also a fixed version.
SeverityHigh
CVSS8.1
Exploit probability74. percentile1.5%
ProductSafe Fme Server
PublishedJun 23, 2023
First seenJun 23, 2023
How to fix
Update
- safe fme_server2022.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| safe fme_server | v < 2022.2.5 | 2022.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.