CVE-2023-48249

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482509.8The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded acCVE-2023-482519.8The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.CVE-2023-482528.8The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.CVE-2023-482538.8The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTCVE-2023-482546.1The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted UCVE-2023-482556.1The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code CVE-2023-482566.3The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s seCVE-2023-482578.8The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) witCVE-2023-482588.1The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’CVE-2023-482597.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-48266.1The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrarCVE-2023-482607.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.
CVE-2023-48249: Medium severity, CVSS 6.5 | Vulnix