medium6.5
CVE-2023-47440
Directory Traversal in Gladys Assistant
Impact
Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | gladys | <= 4.27.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gladysassistant | Gladys Assistant | before 4.30.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.moku.fr/cve/
- https://blog.moku.fr/cves/CVE-2023-47440/
- https://github.com/GladysAssistant/Gladys/pull/1918/commits/4f56ba250ff9f46578f1afa6a97e62e74bad83b7
- https://github.com/advisories/GHSA-c79f-pqgf-fhp3
- https://nvd.nist.gov/vuln/detail/CVE-2023-47440