CVE-2023-4544 Byzoro Smart S85F Management Platform php.ini direct request
Remote attackers can directly request the php.ini configuration file to disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4544?
CVE-2023-4544 is a medium-severity vulnerability in Byzoro Smart S85F Management Platform, published on 26 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230809. It has been rated as problematic. This issue affects some unknown processing of the file /config/php.ini. The manipulation leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238049 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-425
Which versions are affected by CVE-2023-4544?
It affects 1 product.
Products include Byzoro Smart S85f Management Platform.
How do I fix CVE-2023-4544?
No fix has been published for CVE-2023-4544 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4544 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4544 exists.
Other vulnerabilities in Byzoro Smart S85F Management Platform
Sources
Also known as GHSA-mh56-636p-hcp5.