How severe is CVE-2023-4743?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 4.8 out of 10.

What type of vulnerability is CVE-2023-4743?

This is classified as CWE-552, which is a common weakness in software security.

CVE-2023-4743 - MEDIUM Severity | CVSS 4.8

Vulnerability Description

A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238632. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Related Vulnerabilities

CVE-2015-4715

MEDIUM

CVSS:4.9(Medium)

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote ad...

CWE-5522015

CVE-2021-24154

MEDIUM

CVSS:4.9(Medium)

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web s...

CWE-5522021

CVE-2021-25004

MEDIUM

CVSS:4.9(Medium)

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server wit...

CWE-5522021

CVE-2021-32752

MEDIUM

CVSS:4.9(Medium)

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any ...

CWE-5522021

CVE-2021-44983

MEDIUM

CVSS:4.9(Medium)

In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column.

CWE-5522021

CVE-2022-2222

MEDIUM

CVSS:4.9(Medium)

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download ...

CWE-5522022