CVE-2023-35843: Path Traversal
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files and data on the server, including configuration files, source code, and other sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35843?
CVE-2023-35843 has been rated as a high severity vulnerability due to its potential to expose sensitive files on the server.
How do I fix CVE-2023-35843?
To fix CVE-2023-35843, update NocoDB to version 0.109.2 or later, which has addressed this path traversal vulnerability.
What is the impact of CVE-2023-35843?
An attacker exploiting CVE-2023-35843 can access arbitrary files on the server, potentially leading to data breaches.
Who is affected by CVE-2023-35843?
CVE-2023-35843 affects NocoDB versions up to and including 0.106.1 and 0.109.1.
Is authentication required to exploit CVE-2023-35843?
No, CVE-2023-35843 can be exploited by unauthenticated attackers, making it particularly dangerous.