CVE-2022-23409 - The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php

MEDIUM

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php

Published Jan 31, 2022

4.9

MEDIUM

CVSS 3.1

EPSS 13.76%

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
http://packetstormsecurity.com/files/165706/Ethercreative-Logs-3.0.3-Path-Traversal.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://plugins.craftcms.com/logs		x_refsource_MISCProductThird Party Advisory
https://sec-consult.com/vulnerability-lab/		x_refsource_MISCExploitThird Party Advisory