Description

Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component.

Remediation

References

CVE-2023-49508

Related Vulnerabilities

MySQL Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2008-7247)

WordPress Plugin WP eCommerce 'collected_data[]' SQL Injection (3.8.4)

WordPress Plugin SMTP by BestWebSoft Cross-Site Scripting (1.0.9)

WordPress Plugin iThemes Exchange:Simple WP Ecommerce Cross-Site Scripting (1.11.18)

Oracle HTTP Server Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2021-4185)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-22 CVE-2023-49508