How severe is CVE-2023-51646?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.2 out of 10.

What type of vulnerability is CVE-2023-51646?

This is classified as CWE-22, which is a common weakness in software security.

CVE-2023-51646 - HIGH Severity | CVSS 7.2

Vulnerability Description

Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the uploadSimpleFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22527.

Related Vulnerabilities

CVE-2016-0709

HIGH

CVSS:7.2(High)

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and c...

CWE-222016

CVE-2016-10751

HIGH

CVSS:7.2(High)

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP...

CWE-222016

CVE-2016-1593

HIGH

CVSS:7.2(High)

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a ....

CWE-222016

CVE-2017-16744

HIGH

CVSS:7.2(High)

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid pla...

CWE-222017

CVE-2017-16788

HIGH

CVSS:7.2(High)

Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users wi...

CWE-222017

CVE-2017-3980

HIGH

CVSS:7.2(High)

A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice...

CWE-222017