CVE-2023-3231 - UJCMS ZIP Package information disclosure

Back Back to CVE browser

MEDIUM

UJCMS ZIP Package information disclosure

Published Jun 14, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.82%

Description

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-231502 is the identifier assigned to this vulnerability.

Affected products

Vendor n/a Product Ujcms Default
n/a
- Version
  6.0.0
  Status
  affected
  Constraints
  -
- Version
  6.0.1
  Status
  affected
  Constraints
  -
- Version
  6.0.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Ujcms

n/a

Version	Status	Constraints
6.0.0	affected	-
6.0.1	affected	-
6.0.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://github.com/ujcms/ujcms/issues/6
exploitissue-trackingVendor Advisory
https://vuldb.com/?ctiid.231502
signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.231502
vdb-entrytechnical-descriptionPermissions Required

Link	Providers	Tags
https://github.com/ujcms/ujcms/issues/6		exploitissue-trackingVendor Advisory
https://vuldb.com/?ctiid.231502		signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.231502		vdb-entrytechnical-descriptionPermissions Required