CVE-2023-4613: Upload Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4613?
CVE-2023-4613 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant.
How can this vulnerability be exploited?
This vulnerability can be exploited by remote attackers without authentication, using the /api/settings/upload endpoint of LG LED Assistant.
What is the severity of CVE-2023-4613?
The severity of CVE-2023-4613 is critical, with a CVSS score of 9.8.
Which versions of LG LED Assistant are affected?
The vulnerability affects version 2.1.45 of LG LED Assistant.
Are there any references for more information about this vulnerability?
Yes, you can find more information about CVE-2023-4613 at the following links: [link1](https://lgsecurity.lge.com/bulletins/idproducts#updateDetails), [link2](https://www.zerodayinitiative.com/advisories/ZDI-23-1221/).