CVE-2023-48246

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482477.5The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) viCVE-2023-482485.4The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script CVE-2023-482496.5The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the applCVE-2023-482509.8The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded acCVE-2023-482519.8The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.CVE-2023-482528.8The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.CVE-2023-482538.8The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTCVE-2023-482546.1The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted UCVE-2023-482556.1The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code CVE-2023-482566.3The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s seCVE-2023-482578.8The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) witCVE-2023-482588.1The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’
CVE-2023-48246: Medium severity, CVSS 6.5 | Vulnix