CVE-2022-23409: The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php

Medium severity · published Jan 31, 2022

CVE-2022-23409

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php

4.9

CVSS

13.8%

EPSS

On KEV

Description

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)13.8% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Logs · Ethercreative

before 3.0.4 · source: NVD

Affected product

Logs

Ethercreative

All Logs CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-23409

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-23409

Exploit

http://packetstormsecurity.com/files/165706/Ethercreative-Logs-3.0.3-Path-Traversal.html

Product

https://plugins.craftcms.com/logs

Exploit

https://sec-consult.com/vulnerability-lab/