CVE-2023-4480

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-4480

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4480.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-4480

Published

2023-09-05T14:43:25.762Z

Modified

2026-07-15T01:48:56.149848779Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Arbitrary File Read in Fusion File Manager

Details

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.

Database specific

{
    "cwe_ids": [
        "CWE-538"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4480.json",
    "cna_assigner": "SNPS"
}

References

Affected packages

Git / github.com/phpfusion/phpfusion

Affected ranges

Type

GIT

Repo

https://github.com/phpfusion/phpfusion

Events

Introduced

Last affected

8ec4e6c98780b615a340ebc6aa6db27500fc8605

Database specific

{
    "cpe": "cpe:2.3:a:php-fusion:phpfusion:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.10.30"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v9.*

v9.10.03

v9.10.30

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4480.json"