CVE-2023-2315 HIGH

CVE-2023-2315: Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2

Vendor Opencart

Product Opencart

Weakness CWE-22 · Path traversal

Published September 26, 2023

Last update September 24, 2024

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server

Key dates

02Disclosure timeline

September 26, 2023 CVE published

September 24, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-2315 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

04Related CVE

CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter CVE-2026-57716 WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field CVE-2026-59542 WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability CVE-2026-66493 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3