Vulnerability · Published Apr 15, 2023 · Assigned by VulDB

CVE-2023-2101moxi624 Mogu Blog v2 uploadPicsByUrl uploadPictureByUrl absolute path traversal

Medium 4.3

In plain English

A medium-severity security flaw in Mogu Blog v2 from moxi624. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.8%top 41.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
moxi624	Mogu Blog v2	5.05.15.2

Weakness: CWE-36 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://vuldb.com/?id.226109 vdb-entry, technical-description
https://vuldb.com/?ctiid.226109 signature, permissions-required
https://github.com/c3p0ooo-Yiqiyin/mogu_blog_v2/blob/main/README.md related
https://github.com/moxi624/mogu_blog_v2/issues/97 exploit, issue-tracking