CVE-2023-49248

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Dec 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-49254.8The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high priviCVE-2023-492507.3Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https CVE-2023-492518.8A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected aCVE-2023-492527.5A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change withouCVE-2023-492539.8Root user password is hardcoded into the device and cannot be changed in the user interface.CVE-2023-492548.8Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the netCVE-2023-492559.8The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the confiCVE-2023-492567.5It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.CVE-2023-492578.8An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root uCVE-2023-492586.1User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability locatedCVE-2023-492597.5The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in aCVE-2023-49264.3The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco
CVE-2023-49248: Medium severity, CVSS 5.5 | Vulnix