CVE-2023-34865
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
CVE-2023-34865 in ujcms 6.0.2 has a directory traversal vulnerability that allows attackers to move files via the rename feature.
Risk Assessment
This vulnerability could lead to unauthorized access to system files, posing a serious threat to data integrity.
Recommendation
It is recommended to update to the latest version of ujcms to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in ujcms 6.0.2
See all- CVE-2023-34747Critical
There is a file upload vulnerability in ujcms version 6.0.2 via the endpoint /api/backend/core/web-file-upload/upload.
- CVE-2026-78140Medium
A vulnerability in Dromara UJCMS up to 10.1.3 in the update function of the file src/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the web-file-template Endpoint component. Executing a manipulation can lead to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been published and may be used.
- CVE-2023-34878High
An issue was discovered in Ujcms v6.0.2 that allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.
Original NVD description (English source)
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature.