CVE-2023-39141
Published: 22 August 2023
Summary
CVE-2023-39141 is a high-severity Path Traversal (CWE-22) vulnerability in Ziahamza Webui-Aria2. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
webui-aria2 at commit 4fe2e contains a path traversal vulnerability tracked as CVE-2023-39141 and assigned CWE-22. The flaw resides in the Node.js server component, specifically node-server.js, and carries a CVSS 3.1 score of 7.5 reflecting network attackability without authentication or user interaction and high impact on confidentiality.
An unauthenticated remote attacker can supply crafted paths to the web interface and retrieve arbitrary files from the underlying host filesystem, achieving unauthorized disclosure of sensitive data stored on the server.
Public references consist of a technical disclosure gist and direct links to the vulnerable code lines but contain no statements regarding patches, workarounds, or vendor mitigation guidance.
The associated EPSS score stands at 0.8559 with an identical recorded peak, indicating sustained exploitation interest since disclosure without a documented rise from a low baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2276
Vulnerability details
webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.