CVE-2023-46496

moderate-risk

Published 2023-12-08

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.

Do I need to act?

0.46% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.3/10 High

NETWORK / LOW complexity

Affected Products (12)

Evershop

Affected Vendors

Evershop

References (4)

Third Party Advisory https://devhub.checkmarx.com/cve-details/CVE-2023-46496/

Not Applicable https://devhub.checkmarx.com/cve-details/Cx943be66a-54cc/

Third Party Advisory https://devhub.checkmarx.com/cve-details/CVE-2023-46496/

Not Applicable https://devhub.checkmarx.com/cve-details/Cx943be66a-54cc/

/ 100

moderate-risk

Severity 29/34 · Critical

Exploitability 2/34 · Minimal

Exposure 17/34 · Moderate