CVE-2023-34843
Published: 29 June 2023
Summary
CVE-2023-34843 is a high-severity Path Traversal (CWE-22) vulnerability in Traggo Traggo. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Traggo Server 0.3.0 is affected by a directory traversal vulnerability tracked as CVE-2023-34843 and mapped to CWE-22. The issue permits an unauthenticated remote attacker to access arbitrary files on the server by submitting a crafted GET request and is rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
An attacker with network access to an exposed Traggo Server instance can exploit the flaw without authentication or user interaction, achieving disclosure of sensitive files stored on the host filesystem.
Public references consist of GitHub repositories containing technical details and proof-of-concept material, but no official vendor advisory or patch information is supplied in the available data. The EPSS score of 0.9239 reflects sustained exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38883
Vulnerability details
Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.