CVE-2023-4171
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 that allows an attacker to remotely manipulate the Files argument, leading to path traversal. The attack can be initiated remotely.
Risk Assessment
This vulnerability poses a risk of unauthorized access to files on the server, potentially leading to the exposure of sensitive data or further attacks on the system.
Recommendation
It is recommended to update the system to the latest version and implement appropriate security measures to mitigate the risk of exploitation of this vulnerability.
Original NVD description (English source)
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \Service\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.