← Back

CVE-2023-46497

nvd nist
Published: Dec 8, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.5
Source: NVD

Description

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.

Affected (12)

Products: Evershop: Evershop
Evershop
1 product
Evershop
Configuration A
12 vulnerable
Vulnerable SoftwareAffected Versions
Evershop
Evershop
Version 1.0.0 beta1
Evershop
Version 1.0.0 beta2
Evershop
Version 1.0.0 beta3
Evershop
Version 1.0.0 beta4
Evershop
Version 1.0.0 beta5
Evershop
Version 1.0.0 beta
Evershop
Version 1.0.0 rc1
Evershop
Version 1.0.0 rc2
Evershop
Version 1.0.0 rc3
Evershop
Version 1.0.0 rc5
Evershop
Version 1.0.0 rc6
Evershop
Version 1.0.0 rc7

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable

Timeline

No history available yet.