CVE-2023-29586 — MEDIUM (5.5)

Vulnerability Description

Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This leads to Arbitrary File Read by allowing any user to copy any directory in the system to a directory they control. NOTE: the Supplier disputes this because only admin users can copy arbitrary folders, and because the 143984 reference is about a different concern (unrelated to directory copying) that was fixed in 3.5b.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Codesector	Teracopy	3.9.7

Related Weaknesses (CWE)

CWE-284

References

FAQ

What is CVE-2023-29586?

CVE-2023-29586 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This leads to Arbitrary File Read by allowing any user to copy any directory in the s...

How severe is CVE-2023-29586?

CVE-2023-29586 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-29586?

Check the references section above for vendor advisories and patch information. Affected products include: Codesector Teracopy.