Arbitrary File Download Vulnerability in rConfig v6.8.0 by Mrojz
CVE-2023-24366

6.5MEDIUM

Key Information:

Vendor

Rconfig

Status
Rconfig
Vendor
CVE Published:
27 March 2023

What is CVE-2023-24366?

An arbitrary file download vulnerability exists in rConfig version 6.8.0 that allows attackers to exploit crafted HTTP requests to download sensitive files from the server. This could lead to unauthorized access to confidential information, which could jeopardize systems and data security. Prompt patching and secure coding practices are essential to mitigate such risks. For more details, refer to the comprehensive guides linked.

References

https://github.com/mrojz/rconfig-exploit/blob/main/rconfi...
https://github.com/mrojz/rconfig-exploit/blob/main/CVE-20...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.