CVE-2023-45880: Path Traversal
GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-45880?
CVE-2023-45880 is a vulnerability in GibbonEdu Gibbon through version 25.0.0 that allows Directory Traversal via the report template builder.
How does CVE-2023-45880 affect GibbonEdu Gibbon?
CVE-2023-45880 allows an attacker to create PHP files outside of the uploads directory through the report template builder in GibbonEdu Gibbon.
What is the severity of CVE-2023-45880?
The severity of CVE-2023-45880 is high with a CVSS score of 7.2.
How can an attacker exploit CVE-2023-45880?
An attacker can exploit CVE-2023-45880 by creating a new Asset Component and setting the templateFileDestination parameter to an arbitrary pathname.
Is there a fix for CVE-2023-45880?
At the moment, there is no known fix for CVE-2023-45880. It is recommended to update to a version of GibbonEdu Gibbon that is not affected by this vulnerability or to apply any patches provided by the vendor.