CVE-2023-2749 HIGH

CVE-2023-2749: A Gain Information vulnerability was found on Download Center.

Vendor Asustor

Product Download Center

Weakness CWE-200 · Info exposure

Published May 31, 2023

Last update January 9, 2025

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below.

Key dates

02Disclosure timeline

May 31, 2023 CVE published

January 9, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-2749 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

04Related CVE

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields CVE-2025-66027 Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings CVE-2025-55242 Xbox Certification Bug Copilot Djando Information Disclosure Vulnerability CVE-2022-41946 TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions