PT-2023-32198 · Unknown · Kphrx Pleroma

Kphrx · Publicado 2023-10-15 · Atualizado 2024-05-17 · CVE-2023-5588

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions kphrx pleroma (affected versions not specified)

Description A vulnerability was found in kphrx pleroma, classified as problematic. It affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high, and the exploitability is told to be difficult.

Recommendations To fix this issue, it is recommended to apply the patch named 2c795094535537a8607cc0d3b7f076a609636f40. As a temporary workaround, consider restricting access to the Pleroma.Emoji.Pack function until the patch is applied.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-5588

GHSA-2C28-M2M7-MF55

Produtos afetados

Kphrx Pleroma

Referências · 13

• https://github.com/kphrx/pleroma/commit/2c795094535537a8607cc0d3b7f076a609636f40 · Correção
• https://github.com/kphrx/pleroma/commits/v2.5.3 · Nota
• https://github.com/kphrx/pleroma/pull/197 · Aviso do Fabricante
• https://github.com/kphrx/pleroma · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5588 · Nota de Segurança
• https://t.me/cvenotify/59501 · Publicação no Telegram
• https://t.me/cibsecurity/72296 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-2c28-m2m7-mf55 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1713679623672693246 · Publicação no Twitter
• https://vuldb.com/?ctiid.242187 · Nota
• https://twitter.com/TheNimbleNerd/status/1768710486873227428 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5588 · Aviso do Fabricante
• https://vuldb.com/?id.242187 · Nota