CVE-2022-23409

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

13.76% chance of exploitation in the next 30 days, 96th percentile

Published

2022-01-31

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/165706/Ethercreative-Logs-3.0.3-Path-Traversal.html
• https://sec-consult.com/vulnerability-lab/

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52241

References

• CVE Record
• NVD entry

Related

• CVE-2022-23400
• CVE-2022-2341
• CVE-2022-2340
• CVE-2022-2342
• CVE-2022-23399
• CVE-2022-2343