GHSA-9chx-2vqw-8vq5

Source

https://github.com/advisories/GHSA-9chx-2vqw-8vq5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-9chx-2vqw-8vq5/GHSA-9chx-2vqw-8vq5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9chx-2vqw-8vq5

Aliases

CVE-2022-23409

Withdrawn

2026-01-23T22:41:41Z

Published

2022-02-01T00:01:00Z

Modified

2026-09-10T03:49:16Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Duplicate Advisory: Path Traversal in the Logs plugin for Craft CMS

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fp63-499m-hq6m. This link is maintained to preserve external references.

Original Description

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-02-08T16:08:49Z",
    "nvd_published_at":  "2022-01-31T08:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / ether/logs

Package

Name: ether/logs
Purl: pkg:composer/ether/logs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.4

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-9chx-2vqw-8vq5/GHSA-9chx-2vqw-8vq5.json"