Skip to main content

Peppermint CVE-2023-46864

MEDIUM
Path Traversal (CWE-22)
2023-10-30 cve@mitre.org
Path Traversal Peppermint
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 30, 2023 - 00:15 nvd
MEDIUM 5.3

DescriptionNVD

Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request.

AnalysisAI

Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. Affected products include: Peppermint. Version information: through 0.2.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Peppermint

View all
CVE-2023-42328 HIGH POC
8.8 Sep 18

An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and ex
CVE-2023-26984 HIGH POC
8.1 Mar 29

An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the

CVE-2023-46863 HIGH POC
7.5 Oct 30

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/downl
CVE-2026-85391 CRITICAL
9.3 Sep 03

Unauthenticated session-token forgery in Peppermint (an open-source self-hosted helpdesk/ticketing platform) versions th
CVE-2026-72561 HIGH
8.8 Aug 11

Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated
CVE-2026-72555 HIGH
8.1 Aug 11

Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or

CVE-2026-85392 MEDIUM
5.3 Sep 03

Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly termina

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2023-46864 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy