CVE-2023-3241
LowCVSS 3.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A vulnerability was found in OTCMS up to version 6.62 that allows path traversal through manipulation of the url argument in the file /admin/read.php?mudi=announContent.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to system files, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update OTCMS to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in OTCMS do wersji 6.62
See all- CVE-2023-3239Low
A vulnerability was found in OTCMS up to version 6.62 that allows path traversal via manipulation of the img argument in the admin/readDeal.php?mudi=readQrCode file.
- CVE-2023-3238Medium
A critical vulnerability has been found in OTCMS up to version 6.62, affecting some unknown processing of the file /admin/read.php?mudi=getSignal. Manipulation of the argument signalUrl leads to server-side request forgery.
- CVE-2023-3237Medium
A critical vulnerability was found in OTCMS up to version 6.62, affecting unknown code. Manipulating the username/password argument with the input admin leads to the use of a hard-coded password.
Original NVD description (English source)
A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS