CVE-2023-2980

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-99 CWE-74

Affected software

Vendor	Product	Versions
Abstrium	Pydio Cells	4.2.0

References

https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712beExploit, Third Party Advisory
https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421Release Notes
https://vuldb.com/?ctiid.230212Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.230212Permissions Required, Third Party Advisory, VDB Entry
https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712beExploit, Third Party Advisory
https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421Release Notes
https://vuldb.com/?ctiid.230212Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.230212Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-298009.8TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFir CVE-2023-298019.8TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServ CVE-2023-298029.8TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg CVE-2023-298039.8TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN CVE-2023-298048.8WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function.CVE-2023-298059.8WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the pro_stor_canceltrans_handler_part_19 function.CVE-2023-298086.1Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.CVE-2023-298099.8SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a craf CVE-2023-29815.4A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processi CVE-2023-298158.8mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-298185.5An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections vi CVE-2023-298195.5An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections vi