CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Path Traversal, Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through 3.0.3.
Explanation of Vulnerability in Simple Terms
MakeStories versions up to 3.0.3 contain a path traversal vulnerability that allows an authenticated attacker to read files outside the intended directory. An attacker with low-level access can craft requests to access sensitive files on the server, such as configuration files or other private data. This vulnerability requires authentication but no user interaction.
What an attacker can do
Read arbitrary files on the server outside the intended application directory.
Potential impact on your site
Sensitive files (config, database credentials, private keys) may be exposed to authenticated users with low privileges.
Conditions required to exploit
Attacker must have a low-privilege account or login credentials for the application.
Key dates
External resources
Related vulnerabilities
