CVE-2023-2117

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
May 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-211704.4In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds check. This could lead CVE-2023-211716.7In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure. This CVE-2023-211727.8In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissCVE-2023-211735.5In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permissioCVE-2023-211747.8In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits due to a permissions bCVE-2023-211757.8In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypaCVE-2023-211764.4In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local deCVE-2023-211775.5In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interacting with due to a miCVE-2023-211784.1In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to local information dCVE-2023-211797.8In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used CVE-2023-21185.4Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send suCVE-2023-211807.5In xmlParseTryOrFinish of parser.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote informat
CVE-2023-2117: Low severity, CVSS 2.7 | Vulnix