CVE-2023-46864: Path Traversal
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-46864?
CVE-2023-46864 is a vulnerability in Peppermint Ticket Management through version 0.2.4 that allows remote attackers to read arbitrary files through a specific API request.
How severe is CVE-2023-46864?
CVE-2023-46864 has a severity rating of 5.3, which is considered medium severity.
How can remote attackers exploit CVE-2023-46864?
Remote attackers can exploit CVE-2023-46864 by sending a specific POST request to the /api/v1/ticket/1/file/download endpoint with a filepath parameter that includes directory traversal sequences to access arbitrary files.
Which version of Peppermint Ticket Management is affected by CVE-2023-46864?
Peppermint Ticket Management version 0.2.4 is affected by CVE-2023-46864.
Is there a fix available for CVE-2023-46864?
At the moment, there is no known fix for CVE-2023-46864. It is recommended to update to a newer version of the software when a fix becomes available.