CVE-2023-53944 — MEDIUM (6.5)

Vulnerability Description

EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassing SecurityManager restrictions. Attackers can send GET requests with encoded directory traversal sequences like /..%5c..%5c to read system files such as /windows/win.ini.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Easyphp	Webserver	14.1

Related Weaknesses (CWE)

CWE-22

References

https://www.easyphp.org/Product
https://www.exploit-db.com/exploits/51430Exploit
https://www.vulncheck.com/advisories/easyphp-webserver-path-traversal-via-directThird Party AdvisoryExploit
https://www.exploit-db.com/exploits/51430Exploit

FAQ

What is CVE-2023-53944?

CVE-2023-53944 is a vulnerability with a CVSS score of 6.5 (MEDIUM). EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassing SecurityManager restrictions. Attacke...

How severe is CVE-2023-53944?

CVE-2023-53944 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-53944?

Check the references section above for vendor advisories and patch information. Affected products include: Easyphp Webserver.