CVE-2023-4480
Medium
Description
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.
SeverityMedium
CVSS5.5
Exploit probability53. percentile0.7%
Product
Php-fusion Phpfusion
PublishedSep 5, 2023
First seenSep 5, 2023
Weakness typeCWE-538CWE-538
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php-fusion phpfusion | v ≤ 9.10.30 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.