CVE-2023-46307

An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connecting to the remote server port specified during setup, an attacker can retrieve local operating system files from the remote system.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2023/Nov/11	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Nov/9	Mailing List Third Party Advisory
https://hub.docker.com/r/buddho/etcd-browser	Product
https://hub.docker.com/r/buddho/etcd-browser/tags	Product
http://seclists.org/fulldisclosure/2023/Nov/11	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Nov/9	Mailing List Third Party Advisory
https://hub.docker.com/r/buddho/etcd-browser	Product
https://hub.docker.com/r/buddho/etcd-browser/tags	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:buddho:etcd_browser:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:28

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2023/Nov/11 - Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2023/Nov/11 - Mailing List, Third Party Advisory
References	~~() http://seclists.org/fulldisclosure/2023/Nov/9 - Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2023/Nov/9 - Mailing List, Third Party Advisory
References	~~() https://hub.docker.com/r/buddho/etcd-browser - Product~~	() https://hub.docker.com/r/buddho/etcd-browser - Product
References	~~() https://hub.docker.com/r/buddho/etcd-browser/tags - Product~~	() https://hub.docker.com/r/buddho/etcd-browser/tags - Product

12 Dec 2023, 17:06

Type	Values Removed	Values Added
References	~~() https://hub.docker.com/r/buddho/etcd-browser/tags -~~	() https://hub.docker.com/r/buddho/etcd-browser/tags - Product
References	~~() http://seclists.org/fulldisclosure/2023/Nov/11 -~~	() http://seclists.org/fulldisclosure/2023/Nov/11 - Mailing List, Third Party Advisory
References	~~() http://seclists.org/fulldisclosure/2023/Nov/9 -~~	() http://seclists.org/fulldisclosure/2023/Nov/9 - Mailing List, Third Party Advisory
References	~~() https://hub.docker.com/r/buddho/etcd-browser -~~	() https://hub.docker.com/r/buddho/etcd-browser - Product
CWE		CWE-22
First Time		Buddho Buddho etcd Browser
CPE		cpe:2.3:a:buddho:etcd_browser:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

07 Dec 2023, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-07 06:15

Updated : 2024-11-21 08:28

NVD link : CVE-2023-46307

Mitre link : CVE-2023-46307

CVE.ORG link : CVE-2023-46307

JSON object : View

Products Affected

buddho

etcd_browser

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

7.5 /10