CVE-2023-1105 - Vulnerability Details - OpenCVE

External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Flatpress	Flatpress

Configuration 1 [-]

cpe:2.3:a:flatpress:flatpress:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170
https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f

History

Tue, 11 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2023-03-01T00:00:00.000Z

Updated: 2025-03-11T14:15:57.436Z

Reserved: 2023-03-01T00:00:00.000Z

Link: CVE-2023-1105

Vulnrichment

Updated: 2024-08-02T05:32:46.384Z

NVD

Status : Modified

Published: 2023-03-01T02:15:51.597

Modified: 2024-11-21T07:38:27.980

Link: CVE-2023-1105

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-1105", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "dateUpdated": "2025-03-11T14:15:57.436Z", "dateReserved": "2023-03-01T00:00:00.000Z", "datePublished": "2023-03-01T00:00:00.000Z"}, "containers": {"cna": {"title": "External Control of File Name or Path in flatpressblog/flatpress", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2023-03-01T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3."}], "affected": [{"vendor": "flatpressblog", "product": "flatpressblog/flatpress", "versions": [{"version": "unspecified", "lessThan": "1.3", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170"}, {"url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-73 External Control of File Name or Path", "cweId": "CWE-73"}]}], "source": {"advisory": "4089a63f-cffd-42f3-b8d8-e80b6bd9c80f", "discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:32:46.384Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170", "tags": ["x_transferred"]}, {"url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-11T14:15:51.323417Z", "id": "CVE-2023-1105", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T14:15:57.436Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170", "tags": ["x_transferred"]}, {"url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:32:46.384Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-1105", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-11T14:15:51.323417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T14:15:54.524Z"}}], "cna": {"title": "External Control of File Name or Path in flatpressblog/flatpress", "source": {"advisory": "4089a63f-cffd-42f3-b8d8-e80b6bd9c80f", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "flatpressblog", "product": "flatpressblog/flatpress", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "1.3", "versionType": "custom"}]}], "references": [{"url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170"}, {"url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f"}], "descriptions": [{"lang": "en", "value": "External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73 External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2023-03-01T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-1105", "state": "PUBLISHED", "dateUpdated": "2025-03-11T14:15:57.436Z", "dateReserved": "2023-03-01T00:00:00.000Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2023-03-01T00:00:00.000Z", "assignerShortName": "@huntrdev"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flatpress:flatpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0EEB64E-678C-4C3E-BE11-60BB6A00193A", "versionEndExcluding": "2022-12-25", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3."}], "id": "CVE-2023-1105", "lastModified": "2024-11-21T07:38:27.980", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-01T02:15:51.597", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security@huntr.dev", "type": "Secondary"}]}