{"id":"CVE-2023-2749","state":"PUBLISHED","title":"A Gain Information vulnerability was found on Download Center.","description":"Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below. ","publishedAt":"2023-05-31T08:36:37.182Z","updatedAt":"2025-01-09T21:02:15.236Z","severity":{"score":8.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","source":"ASUSTOR1"},"assigner":"ASUSTOR1","products":["ASUSTOR Download Center"],"affected":[{"vendor":"ASUSTOR","product":"Download Center","defaultStatus":"unaffected","versions":[{"version":"1.1.5","status":"affected","lessThanOrEqual":"1.1.5.r1280","versionType":"custom"}],"platforms":["Linux","x86","ARM","64 bit"]}],"references":["https://www.asustor.com/security/security_advisory_detail?id=24"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/2xxx/CVE-2023-2749.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-2749","state":"PUBLISHED","datePublished":"2023-05-31T08:36:37.182Z","dateUpdated":"2025-01-09T21:02:15.236Z","assignerShortName":"ASUSTOR1","assignerOrgId":"f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77","dateReserved":"2023-05-17T05:56:36.390Z"},"containers":{"cna":{"title":"A Gain Information vulnerability was found on Download Center.","descriptions":[{"lang":"en","value":"Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below. "}],"affected":[{"vendor":"ASUSTOR","product":"Download Center","defaultStatus":"unaffected","versions":[{"version":"1.1.5","status":"affected","lessThanOrEqual":"1.1.5.r1280","versionType":"custom"}],"platforms":["Linux","x86","ARM","64 bit"]}],"references":[{"url":"https://www.asustor.com/security/security_advisory_detail?id=24","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ASUSTOR1","orgId":"f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77","dateUpdated":"2023-05-31T08:36:37.182Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Zhiyong Xing, Inner Mongolia Xinyuan Network Security Technology Co., Ltd., China"}],"datePublic":"2023-06-01T02:10:00.000Z","impacts":[{"capecId":"CAPEC-410","descriptions":[{"lang":"en","value":"CAPEC-410 Information Elicitation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.asustor.com/security/security_advisory_detail?id=24","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:33:05.379Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-09T21:01:53.722872Z","id":"CVE-2023-2749","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-09T21:02:15.236Z"}}]}}}