CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.15.
Explanation of Vulnerability in Simple Terms
Besa versions 2.3.15 and earlier contain a vulnerability that allows an attacker to read sensitive data, modify content, or disrupt service availability. The attack requires network access and high technical complexity but no authentication or user interaction. The vulnerability affects the confidentiality, integrity, and availability of the affected system.
What an attacker can do
Read sensitive data, modify content, or disrupt service availability without authentication.
Potential impact on your site
Unauthorized access to sensitive data, content modification, or service disruption on affected Besa installations.
Conditions required to exploit
Network access and high technical complexity to exploit; no authentication required.
Key dates
External resources
Related vulnerabilities
