CVE-2023-45880

published 2023-11-14

CVE-2023-45880: GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The…

Priority P3 43 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
gibbonedu	gibbon	<= 25.0.00	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22