CVE-2023-4172
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0, allowing absolute path traversal via the FileDirectory argument in the file Service/FileHandler.ashx. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk involves the potential for remote reading of arbitrary files outside the allowed directory, which could lead to exposure of sensitive system or configuration data.
Recommendation
Immediately update the system to the latest version if a patch is available, or apply temporary mitigations such as validating and restricting file paths in the FileDirectory parameter.
Original NVD description (English source)
A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \Service\FileHandler.ashx. The manipulation of the argument FileDirectory leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236207.