Dreamer Cms CVE-2023-43856

HIGH

Files or Directories Accessible to External Parties (CWE-552)

2023-09-27 cve@mitre.org

Information Disclosure Path Traversal Dreamer Cms

7.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Sep 27, 2023 - 15:19 nvd

HIGH 7.5

DescriptionNVD

Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.

AnalysisAI

Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-552. Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java. Affected products include: Iteachyou Dreamer Cms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Dreamer Cms

View all

CVE-2023-42279 CRITICAL Act Now POC

Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form. Rat

CVE-2022-42245 CRITICAL Act Now POC

Dreamer CMS 4.0.01 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex

CVE-2023-46886 CRITICAL Act Now POC

Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Rated critical severity (CVSS 9.1), this vulnerab

CVE-2024-3311 HIGH This Week POC

A vulnerability was found in Dreamer CMS up to 4.1.3.0. Rated high severity (CVSS 8.8), this vulnerability is remotely e

CVE-2023-7091 HIGH This Week POC

A vulnerability was found in Dreamer CMS 4.1.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab

CVE-2023-50017 HIGH This Week POC

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backu

CVE-2023-48914 HIGH This Week POC

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.

CVE-2023-48913 HIGH This Week POC

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delet

CVE-2023-48912 HIGH This Week POC

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.

CVE-2023-48017 HIGH This Week POC

Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Managemen

CVE-2023-48021 HIGH This Week POC

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update. R

CVE-2023-48020 HIGH This Week POC

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeSta

Same weakness CWE-552 – Files or Directories Accessible to External Parties

View all

CVE-2016-3715 MEDIUM POC

CVE-2017-16651 HIGH POC

CVE-2023-6266 HIGH POC

CVE-2021-22015 HIGH POC

CVE-2017-14942 CRITICAL POC

CVE-2015-5211 CRITICAL POC

CVE-2020-37082 CRITICAL POC

CVE-2024-53676 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2023-43856 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy