CVE-2023-3512
Last modified
CVE-2023-3512 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Setelsa-Security | Conacwin | <= 3.8.2.2 |
References
- https://github.com/advisories/GHSA-v6jm-v768-76h2Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-3512?
How severe is CVE-2023-3512?
How do I fix CVE-2023-3512?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-35097Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
- CVE-2023-35098Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
- CVE-2023-3510The FTP Access WordPress plugin through 1.0 does not have au…5.4
- CVE-2023-3511An issue has been discovered in GitLab EE affecting all vers…3.5
- CVE-2023-35110An issue was discovered jjson thru 0.1.7 allows attackers to…7.5
- CVE-2023-35116jackson-databind through 2.15.2 allows attackers to cause a …4.7
- CVE-2023-35120 PiiGAB M-Bus is vulnerable to cross-site request forgery. A…8.8
- CVE-2023-35121Improper access control in the Intel(R) oneAPI DPC++/C++ Com…7.8
- CVE-2023-35123Uncaught exception in OpenBMC Firmware for some Intel(R) Ser…5.9
- CVE-2023-35124An information disclosure vulnerability exists in the OAS En…4.3
- CVE-2023-35126An out-of-bounds write vulnerability exists within the parse…7.8
- CVE-2023-35127Stack-based buffer overflow may occur when Fuji Electric Tel…7.8
Are you affected by CVE-2023-3512?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST