CVE-2022-23409
published 2022-01-31CVE-2022-23409: The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
PriorityP343medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EXPLOIT
EPSS
13.76%
96.0th percentile
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ether | logs | >= 0 < 3.0.4 | 3.0.4 |
| ethercreative | logs | < 3.0.4 | 3.0.4 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/165706/Ethercreative-Logs-3.0.3-Path-Traversal.htmlhttps://plugins.craftcms.com/logshttps://sec-consult.com/vulnerability-lab/http://packetstormsecurity.com/files/165706/Ethercreative-Logs-3.0.3-Path-Traversal.htmlhttps://plugins.craftcms.com/logshttps://sec-consult.com/vulnerability-lab/
2022-01-31
Published