CVE-2023-35860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35860
A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system information via the dir parameter to listing.php or rss.php.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:moderncampus:omni_cms:2023.1:*:*:*:*:*:*:*
History

14 Aug 2024, 16:05

Type Values Removed Values Added
CWE CWE-22
CPE cpe:2.3:a:moderncampus:omni_cms:2023.1:*:*:*:*:*:*:*
First Time Moderncampus
Moderncampus omni Cms
References () https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve - () https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve - Vendor Advisory

01 Aug 2024, 13:43

Type Values Removed Values Added
CWE CWE-31
Summary
  • (es) Una vulnerabilidad de Directory Traversal en Modern Campus: Omni CMS 2023.1 permite que un atacante remoto no autenticado enumere información del sistema de archivos a través del parámetro dir en listado.php o rss.php.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

13 Jun 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-13 16:15

Updated : 2024-08-14 16:05

NVD link : CVE-2023-35860

Mitre link : CVE-2023-35860

CVE.ORG link : CVE-2023-35860

JSON object : View

Products Affected

moderncampus

  • omni_cms
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-31

Path Traversal: 'dir\..\..\filename'