What is the severity of CVE-2023-6849?

CVE-2023-6849 has been rated as critical due to its potential for server-side request forgery.

How do I fix CVE-2023-6849?

To fix CVE-2023-6849, update kodbox to a version above 1.48.04.

Which component is affected by CVE-2023-6849?

CVE-2023-6849 affects the function cover in the file plugins/fileThumb/app.php.

Can CVE-2023-6849 be exploited remotely?

Yes, CVE-2023-6849 can be exploited remotely.

What type of security issue is CVE-2023-6849?

CVE-2023-6849 is categorized as a server-side request forgery vulnerability.

Vulnerability/
CVE-2023-6849

critical

9.8

CWE

918

EPSS

0.063%

16/12/2023

27/8/2024

CVE-2023-6849: kalcaddle kodbox app.php cover server-side request forgery

First published: Sat Dec 16 2023(Updated: )

A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.48.04 is able to address this issue. The patch is identified as 63a4d5708d210f119c24afd941d01a943e25334c. It is recommended to upgrade the affected component. VDB-248210 is the identifier assigned to this vulnerability.

Credit: cna@vuldb.com

Affected Software	Affected Version	How to fix
Kodcloud	<1.48.04

Remedy

https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2023-6849?
CVE-2023-6849 has been rated as critical due to its potential for server-side request forgery.
How do I fix CVE-2023-6849?
To fix CVE-2023-6849, update kodbox to a version above 1.48.04.
Which component is affected by CVE-2023-6849?
CVE-2023-6849 affects the function cover in the file plugins/fileThumb/app.php.
Can CVE-2023-6849 be exploited remotely?
Yes, CVE-2023-6849 can be exploited remotely.
What type of security issue is CVE-2023-6849?
CVE-2023-6849 is categorized as a server-side request forgery vulnerability.

agent/type
agent/first-publish-date
agent/remedy
agent/severity
agent/weakness
agent/title
agent/references
agent/author
agent/description
collector/epss-latest
source/FIRST
agent/epss
agent/softwarecombine
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
agent/tags
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/kodcloud
canonical/kodcloud

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.