CVE-2023-46863: Path Traversal
Published Oct 29, 2023
·Updated
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.
Affected Software
1 affected component
Peppermint Peppermint<0.2.4
Event History
Oct 29, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Oct 30, 2023
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-46863.
2
What is the severity of CVE-2023-46863?
The severity of CVE-2023-46863 is high with a score of 7.5.
3
What is the affected software of CVE-2023-46863?
The affected software of CVE-2023-46863 is Peppermint Ticket Management before version 0.2.4.
4
How can remote attackers exploit CVE-2023-46863?
Remote attackers can exploit CVE-2023-46863 by sending a POST request to /api/v1/users/file/download?filepath=./../.
5
How can I fix CVE-2023-46863?
To fix CVE-2023-46863, it is recommended to update Peppermint Ticket Management to version 0.2.4 or newer.