CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
Explanation of Vulnerability in Simple Terms
BM Content Builder versions 3.16.3.3 and earlier contain a path traversal vulnerability that allows authenticated users to cause the site to become unavailable. An attacker with low-level access can manipulate file paths to trigger a denial-of-service condition affecting the entire application. The vulnerability requires network access and valid credentials but no user interaction.
What an attacker can do
Make the site unavailable (denial of service) by exploiting path traversal in file handling.
Potential impact on your site
Site downtime and loss of availability for all users until the vulnerability is patched.
Conditions required to exploit
Attacker must have a low-privilege user account; network access to the site.
Key dates
External resources
