CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Absolute Path Traversal, : Server Side Request Forgery.This issue affects ICS Calendar: from n/a through 10.12.0.3.
Explanation of Vulnerability in Simple Terms
ICS Calendar versions up to 10.12.0.3 contain a path traversal vulnerability that allows unauthenticated attackers to read files from the server. An attacker can access sensitive files outside the intended directory by crafting malicious requests. This vulnerability requires no authentication or user interaction and can expose configuration files, database credentials, and other sensitive data.
What an attacker can do
Read arbitrary files from the server, including configuration files and sensitive data.
Potential impact on your site
Attackers can access sensitive files like database credentials, configuration, and private data without logging in.
Conditions required to exploit
Network access to the vulnerable ICS Calendar installation; no authentication required.
Key dates
External resources
Related vulnerabilities
