Description

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

Remediation

References

CVE-2023-28330

Related Vulnerabilities

WordPress Ultimate Member Plugin Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2022-3361)

Oracle JRE CVE-2013-2453 Vulnerability (CVE-2013-2453)

WordPress Plugin Query Interface Security Bypass (1.1)

Drupal Reliance on Cookies without Validation and Integrity Checking Vulnerability (CVE-2022-29248)

WordPress Plugin NextGEN Gallery-WordPress Gallery Cross-Site Scripting (2.2.10)

Severity

Medium

Classification

CVE-2023-28330 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities