id: CVE-2023-0947 info: name: Flatpress < 1.3 - Path Traversal author: r3Y3r53 severity: critical description: | Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. reference: - https://huntr.dev/bounties/7379d702-72ff-4a5d-bc68-007290015496/ - https://nvd.nist.gov/vuln/detail/CVE-2023-0947 - https://github.com/flatpressblog/flatpress/commit/9c4e5d6567e446c472f3adae3b2fe612f66871c7 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-0947 cwe-id: CWE-22 epss-score: 0.0114 epss-percentile: 0.84427 cpe: cpe:2.3:a:flatpress:flatpress:*:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: flatpress product: flatpress shodan-query: http.favicon.hash:-1189292869 tags: cve,cve2023,huntr,lfi,flatpress,listing http: - method: GET path: - "{{BaseURL}}/fp-content/" - "{{BaseURL}}/flatpress/fp-content/" stop-at-first-match: true matchers: - type: dsl dsl: - 'status_code == 200' - 'contains(body, "Index of /fp-content")' condition: and # digest: 4a0a00473045022100a6fad072aa7b7a33eeb7febfa517c81a87cdd0458f78e659f4436d97e14cda8c02201122c5d07ec27092761f1e6d267c54e6cd56b9d6df20fe247ee60f0783601bd2:922c64590222798bb761d5b6d8e72950