Vulnerability · Published Dec 20, 2023 · Assigned by Google
CVE-2023-6562
High 7.5
In plain English
A high-severity path traversal in Kakadu SDK from Kakadu Software Pty Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted the image that is displayed back to the attacker.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kakadu Software Pty Ltd | Kakadu SDK | 4.4 – before 8.4 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N