CVE-2023-0046 Improper Restriction of Names for Files and Other Resources in lirantal/daloradius
Attackers can exploit improper file name restrictions in DaloRADIUS to access or modify unauthorized files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0046?
CVE-2023-0046 is a high-severity path traversal vulnerability in lirantal/daloradius, published on 4 Jan 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
Weakness: CWE-641
Which versions are affected by CVE-2023-0046?
It affects 1 product.
Products include Daloradius Daloradius.
How do I fix CVE-2023-0046?
No fix has been published for CVE-2023-0046 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-0046 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0046 exists.
Other vulnerabilities in lirantal/daloradius
- CVE-2022-23475 dalorRadius full account take over
- CVE-2023-0048 Code Injection in lirantal/daloradius
- CVE-2023-0337 Cross-site Scripting (XSS) - Reflected in lirantal/daloradius
- CVE-2023-0338 Cross-site Scripting (XSS) - Reflected in lirantal/daloradius
- CVE-2022-4630 Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius
Sources
Also known as GHSA-9rw8-hqcq-vxh4.