CVE-2023-37739
Published: 14 September 2023
Summary
CVE-2023-37739 is a medium-severity Path Traversal (CWE-22) vulnerability in I-Doit I-Doit. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
i-doit Pro versions 25 and below contain a path traversal vulnerability tracked as CVE-2023-37739. The flaw is classified under CWE-22 and carries a CVSS 3.1 score of 6.5, reflecting network attack vector, low attack complexity, and low privileges required.
An authenticated remote attacker can supply crafted path sequences to read arbitrary files outside the intended web root, resulting in disclosure of sensitive data stored on the server while leaving integrity and availability unaffected.
The two public references consist of a proof-of-concept repository and a technical write-up; neither provides vendor advisory text or patch details. The associated EPSS score has remained flat at 0.1006 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-41616
Vulnerability details
i-doit Pro v25 and below was discovered to be vulnerable to path traversal.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.