CVE-2023-48257

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1391CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482588.1The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’CVE-2023-482597.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-48266.1The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrarCVE-2023-482607.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-482617.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-482629.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482639.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482649.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482659.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482669.8The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code ExeCVE-2023-482677.9Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to poCVE-2023-482687.5Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacke
CVE-2023-48257: High severity, CVSS 8.8 | Vulnix