CVE-2023-46493: Path Traversal
Published Dec 8, 2023
·Updated
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js.
Affected Software
13 affected componentsFixes available
npm/@evershop/evershop<1.0.0-rc.8
1.0.0-rc.8
evershop Evershop Node.js=1.0.0-beta
evershop Evershop Node.js=1.0.0-beta1
evershop Evershop Node.js=1.0.0-beta2
evershop Evershop Node.js=1.0.0-beta3
evershop Evershop Node.js=1.0.0-beta4
evershop Evershop Node.js=1.0.0-beta5
evershop Evershop Node.js=1.0.0-rc1
evershop Evershop Node.js=1.0.0-rc2
evershop Evershop Node.js=1.0.0-rc3
evershop Evershop Node.js=1.0.0-rc5
evershop Evershop Node.js=1.0.0-rc6
evershop Evershop Node.js=1.0.0-rc7
Event History
Dec 8, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Advisory Published
09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-46493?
CVE-2023-46493 is classified as a high-severity directory traversal vulnerability.
2
How do I fix CVE-2023-46493?
To fix CVE-2023-46493, upgrade to EverShop NPM version 1.0.0-rc.8 or later.
3
What does CVE-2023-46493 exploit?
CVE-2023-46493 exploits a directory traversal flaw in the readDirSync function in fileBrowser/browser.js.
4
Which versions of EverShop are affected by CVE-2023-46493?
CVE-2023-46493 affects EverShop NPM versions prior to 1.0.0-rc.8.
5
Can CVE-2023-46493 be exploited remotely?
Yes, CVE-2023-46493 can be exploited remotely by an attacker to obtain sensitive information.