CVE-2022-46154 - Arbitrary file access in KodExplorer

Back Back to CVE browser

HIGH

Arbitrary file access in KodExplorer

Published Dec 6, 2022

8.6

HIGH

CVSS 3.1

EPSS 0.89%

Description

Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

Vendor Kalcaddle Product KodExplorer Default
n/a
- Version
  < 4.50
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kalcaddle

KodExplorer

n/a

Version	Status	Constraints
< 4.50	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-48988
Advisory
https://github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98c
x_refsource_MISCPatchThird Party Advisory
https://github.com/kalcaddle/KodExplorer/security/advisories/GHSA-6f8p-4w5q-j5j2
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-48988		Advisory
https://github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98c		x_refsource_MISCPatchThird Party Advisory
https://github.com/kalcaddle/KodExplorer/security/advisories/GHSA-6f8p-4w5q-j5j2		x_refsource_CONFIRMThird Party Advisory