PT-2023-32198 · Unknown · Kphrx Pleroma

Kphrx · Published 2023-10-15 · Updated 2024-05-17 · CVE-2023-5588

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions kphrx pleroma (affected versions not specified)

Description A vulnerability was found in kphrx pleroma, classified as problematic. It affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high, and the exploitability is told to be difficult.

Recommendations To fix this issue, it is recommended to apply the patch named 2c795094535537a8607cc0d3b7f076a609636f40. As a temporary workaround, consider restricting access to the Pleroma.Emoji.Pack function until the patch is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-5588

GHSA-2C28-M2M7-MF55

Affected Products

Kphrx Pleroma

References · 13

• https://github.com/kphrx/pleroma/commit/2c795094535537a8607cc0d3b7f076a609636f40 · Patch
• https://github.com/kphrx/pleroma/pull/197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5588 · Security Note
• https://osv.dev/vulnerability/GHSA-2c28-m2m7-mf55 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5588 · Vendor Advisory
• https://github.com/kphrx/pleroma/commits/v2.5.3 · Note
• https://github.com/kphrx/pleroma · Note
• https://t.me/cvenotify/59501 · Telegram Post
• https://t.me/cibsecurity/72296 · Telegram Post
• https://twitter.com/CVEnew/status/1713679623672693246 · Twitter Post
• https://vuldb.com/?ctiid.242187 · Note
• https://twitter.com/TheNimbleNerd/status/1768710486873227428 · Twitter Post
• https://vuldb.com/?id.242187 · Note