CVE-2023-4171: medium-severity vulnerability in Chengdu Flash Flood Disaster Monitoring and…
Chengdu Flash Flood Disaster Monitoring and Warning System FileDownload.ashx path traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 1.1%
A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \Service\FileDownload.ashx. The manipulation of the argument Files leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-236206 is the identifier assigned to this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Chengdu · Flash Flood Disaster Monitoring and Warning SystemRelated CVEs — Chengdu Flash Flood Disaster Monitoring and…
In the same product, most dangerous first.
CVE-2023-3802MEDIUMChengdu Flash Flood Disaster Monitoring and Warning System Ajaxfileupload.ashx unrestricted uploadEPSS 1.0%CVE-2023-4172MEDIUMChengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx absolute path traversalEPSS 0.9%CVE-2023-3804MEDIUMChengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx unrestricted uploadEPSS 0.9%CVE-2023-3798MEDIUMChengdu Flash Flood Disaster Monitoring and Warning System upload.aspx unrestricted uploadEPSS 0.9%CVE-2023-3803LOWChengdu Flash Flood Disaster Monitoring and Warning System File Name ImageStationDataService.asmx random valuesEPSS 0.7%