Arbitrary File Download Vulnerability in Novel-Plus by Mesec
CVE-2022-36671

7.5HIGH

Key Information:

Vendor

Xxyopen

Status
Novel-plus
Vendor
CVE Published:
1 September 2022

What is CVE-2022-36671?

Novel-Plus v3.6.2 has been found to have a vulnerability that allows unauthorized users to download files from the server through the background file download API. This can lead to the exposure of sensitive data and system information, making it crucial for users to apply necessary patches and security updates to mitigate risks associated with this flaw.

References

https://www.mesec.cn/archives/291
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.