High severity · published Dec 6, 2022
CVE-2022-46154
Arbitrary file access in KodExplorer
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
KodExplorer · kalcaddle
< 4.50 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-46154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-46154
Patch
https://github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98c
Third Party Advisory
https://github.com/kalcaddle/KodExplorer/security/advisories/GHSA-6f8p-4w5q-j5j2
More from KodExplorer
9.8
CVE-2023-6853
kalcaddle KodExplorer app.php index server-side request forgery
9.8
CVE-2023-6852
kalcaddle KodExplorer app.php server-side request forgery
9.8
CVE-2023-6851
kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
9.8
CVE-2023-6850
kalcaddle KodExplorer API Endpoint unrestricted upload
8.8
CVE-2022-4944
kalcaddle KodExplorer cross-site request forgery