CVE-2023-5355

CWE-22 — Path TraversalCWE-284 — Improper Access Control3 documents3 sources
Severity
8.1HIGH
EPSS
0.2%
top 62.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Awesome SupportGetawesomesupport Awesome Support
Timeline
PublishedNov 6

Description

The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5unknown/awesome_support< 6.1.5

🔴Vulnerability Details

2
CVEList
Awesome Support < 6.1.5 - Submitter+ Arbitrary File Deletion↗2023-11-06
▶
GHSA
GHSA-x85w-8f7w-627g: The Awesome Support WordPress plugin before 6↗2023-11-06
▶
CVE-2023-5355 (HIGH CVSS 8.1) | The Awesome Support WordPress plugi | cvebase.io