#VU79987 Path traversal in Simple Editor - CVE-2023-40499

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU79987

#VU79987 Path traversal in Simple Editor - CVE-2023-40499

Published: August 25, 2023


Vulnerability identifier: #VU79987
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-40499
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Simple Editor
Software vendor:
LG Electronics

Description

The vulnerability allows a remote attacker to delete arbitrary files on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences within the mkdir command implemented in the makeDetailContent method. A remote attacker can send a specially crafted HTTP request and delete arbitrary files on the system.


Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links