Directory Traversal Vulnerability in Wuzhicms by Wuzhicms
CVE-2022-36168

2.7LOW

Key Information:

Vendor

Wuzhicms

Status
Wuzhicms
Vendor
CVE Published:
26 August 2022

What is CVE-2022-36168?

A directory traversal vulnerability was identified in Wuzhicms version 4.1.0, where unauthorized users could potentially access sensitive files on the server through inadequate input validation in the attachment management endpoint. This vulnerability exposes the application to risk, allowing attackers to traverse directories and retrieve files beyond the intended access scope. Implementing proper access controls and input sanitization is crucial to mitigate this issue effectively.

References

https://github.com/wuzhicms/wuzhicms/issues/202
x_refsource_MISC
https://github.com/Cigar-Fasion/CVE/issues/1
x_refsource_MISC

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.