CVE-2023-24188

CriticalCVSS 9.1

Published: 13/02/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.20%

64th percentile - higher than 64% of all known CVEs

Summary

A directory traversal vulnerability was discovered in ureport version 2.2.9 within the deletion function, allowing arbitrary file deletion.

Risk Assessment

The risk involves the potential deletion of critical system or configuration files, which could lead to application or system downtime.

Recommendation

Immediately upgrade ureport to the latest available version that fixes this vulnerability. If an upgrade is not possible, restrict access to the file deletion function to trusted users only.

Other vulnerabilities in ureport

See all

CVE-2026-38158Critical
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to inject malicious SQL queries. This flaw enables unauthorized access to sensitive database information.
CVE-2023-24187High
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code by uploading a crafted XML file to /ureport/designer/saveReportFile.

Original NVD description (English source)

ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.