CVE-2023-33756 Path traversal in n/a

What is CVE-2023-33756?

CVE-2023-33756 is a high-severity path traversal vulnerability in n/a, published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue in the SpreadSheetPlugin component of Foswiki v2.1.7 and below allows attackers to execute a directory traversal.

Weakness: CWE-22

Which versions are affected by CVE-2023-33756?

It affects 1 product.

Products include Foswiki Foswiki.

How do I fix CVE-2023-33756?

No fix has been published for CVE-2023-33756 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-33756 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33756 exists.

Other vulnerabilities in n/a

• CVE-2013-1666 Code injection in n/a Critical 9.8
• CVE-2023-24698 Path traversal in n/a High 7.5
• CVE-2026-2861 Foswiki Changes/Viewfile/Oops information disclosure Medium 6.9
• CVE-2009-1434 Cross-site request forgery in n/a Medium 6.8
• CVE-2010-4215 Privilege escalation in n/a Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7966-q28j-7rvr.