Description
Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.
Remediation
References
https://blog.moku.fr/cve/
https://blog.moku.fr/cves/CVE-2023-47440/
https://github.com/GladysAssistant/Gladys/pull/1918/commits/4f56ba250ff9f46578f1afa6a97e62e74bad83b7
Related Vulnerabilities
CVE-2012-0838 Vulnerability in maven package org.apache.struts.xwork:xwork-core
CVE-2023-30519 Vulnerability in maven package org.jenkins-ci.plugins:quayio-trigger
CVE-2020-14968 Vulnerability in maven package org.webjars.npm:jsrsasign
CVE-2013-6393 Vulnerability in npm package libyaml
CVE-2023-47323 Vulnerability in maven package org.silverpeas.core:silverpeas-core-api