Vulnerability · Published Sep 5, 2023 · Assigned by SNPS

CVE-2023-4480Arbitrary File Read in Fusion File Manager

Medium 5.5

In plain English

A medium-severity security flaw in PHPFusion from PHPFusion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.

Affected products (as reported)

Vendor	Product	Versions
PHPFusion	PHPFusion	0 – through 9.10.30

Weakness: CWE-538 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

References

https://www.synopsys.com/blogs/software-security/cyrc-vulnerability-advisory-cve-2023-2453/