{"id":"CVE-2023-4475","state":"PUBLISHED","title":"An Arbitrary File Movement vulnerability was found on the ADM","description":"An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.\n","publishedAt":"2023-08-22T09:02:30.376Z","updatedAt":"2024-10-02T20:02:50.949Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","source":"ASUSTOR1"},"assigner":"ASUSTOR1","products":["ASUSTOR ADM"],"affected":[{"vendor":"ASUSTOR","product":"ADM","packageName":"File Explorer","defaultStatus":"affected","versions":[{"version":"4.0","status":"affected","lessThanOrEqual":"4.0.6.RIS1","versionType":"custom"},{"version":"4.1","status":"affected","lessThanOrEqual":"4.1.0.RLQ1","versionType":"custom"},{"version":"4.2","status":"affected","lessThanOrEqual":"4.2.2.RI61","versionType":"custom"}],"platforms":["Linux","x86","ARM","64 bit"]}],"references":["https://www.asustor.com/security/security_advisory_detail?id=30"],"weaknesses":["CWE-552"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4475.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-4475","state":"PUBLISHED","datePublished":"2023-08-22T09:02:30.376Z","dateUpdated":"2024-10-02T20:02:50.949Z","assignerShortName":"ASUSTOR1","assignerOrgId":"f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77","dateReserved":"2023-08-22T07:08:47.286Z"},"containers":{"cna":{"title":"An Arbitrary File Movement vulnerability was found on the ADM","descriptions":[{"lang":"en","value":"An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below.\n"}],"affected":[{"vendor":"ASUSTOR","product":"ADM","packageName":"File Explorer","defaultStatus":"affected","versions":[{"version":"4.0","status":"affected","lessThanOrEqual":"4.0.6.RIS1","versionType":"custom"},{"version":"4.1","status":"affected","lessThanOrEqual":"4.1.0.RLQ1","versionType":"custom"},{"version":"4.2","status":"affected","lessThanOrEqual":"4.2.2.RI61","versionType":"custom"}],"platforms":["Linux","x86","ARM","64 bit"]}],"references":[{"url":"https://www.asustor.com/security/security_advisory_detail?id=30","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","description":"CWE-552 Files or Directories Accessible to External Parties","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ASUSTOR1","orgId":"f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77","dateUpdated":"2023-08-22T09:02:30.376Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Stéphane Chauveau (stephane@chauveau-central.net)"}],"datePublic":"2023-08-30T07:15:00.000Z","impacts":[{"capecId":"CAPEC-165","descriptions":[{"lang":"en","value":"CAPEC-165 File Manipulation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.asustor.com/security/security_advisory_detail?id=30","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:31:05.523Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-02T20:00:13.355436Z","id":"CVE-2023-4475","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-02T20:02:50.949Z"}}]}}}