CVE-2013-1891 Path traversal in opencart
Attackers can bypass anti-traversal protections in OpenCart's file manager to read or modify arbitrary files on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-1891?
CVE-2013-1891 is a medium-severity path traversal vulnerability in opencart, published on 24 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.
Weakness: CWE-22
Which versions are affected by CVE-2013-1891?
It affects 1 product.
Products include Opencart Opencart.
How do I fix CVE-2013-1891?
No fix has been published for CVE-2013-1891 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2013-1891 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-1891 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in opencart
Sources
Also known as GHSA-524g-q546-2rwr.