CVE-2022-23409
Published: 31 January 2022
Summary
CVE-2022-23409 is a medium-severity Path Traversal (CWE-22) vulnerability in Ethercreative Logs. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a path traversal flaw (CWE-22) in the Ethercreative Logs plugin for Craft CMS, present in all versions before 3.0.4. It resides in the actionStream method of Controller.php and permits an attacker to supply crafted input that traverses the filesystem and retrieves arbitrary files.
An authenticated user holding high privileges, such as an administrator account, can exploit the issue over the network by sending a malicious request to the affected controller action. Successful exploitation yields read access to sensitive files on the server while leaving integrity and availability unaffected.
Public references, including a proof-of-concept on Packet Storm and the SEC Consult vulnerability lab, indicate that the vendor addressed the flaw by releasing version 3.0.4; administrators are advised to update the plugin promptly through the Craft CMS plugin marketplace. The EPSS score has remained flat at 0.0641 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-0935
Vulnerability details
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.