PT-2025-51945 · Bludit · Bludit+1

Antonio Cuomo · Publicado 2025-12-17 · Atualizado 2025-12-20 · CVE-2023-53907

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.13.1

Description A file download issue exists in the Backup Plugin within Bludit. Logged-in users can access arbitrary files. Attackers can exploit the plugin’s download functionality by manipulating file path parameters, potentially leading to the reading of sensitive system files through directory traversal.

Recommendations Update to version 3.13.1 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-53907

Produtos afetados

Db Backup Plugin

Bludit

Referências · 6

• 🔥 https://exploit-db.com/exploits/51541 · Exploit
• https://bludit.com · Nota
• https://vulncheck.com/advisories/bludit-authenticated-arbitrary-file-download-via-backup-plugin · Nota
• https://twitter.com/CVEnew/status/2002487798188945791 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-53907 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-53907 · Aviso do Fabricante