CVE-2023-4743
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk39th percentile — higher than 39% of all known CVEs
Summary
A vulnerability was found in Dreamer CMS up to version 4.1.3 that allows remote access to files or directories through manipulation of the file /upload/ueditorConfig?action=config. It is classified as problematic with a high complexity of attack.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data within the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update Dreamer CMS to the latest version to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238632. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.