Cyber Resilience

CVE-2023-42227

High

Published: 13 January 2025

Published
13 January 2025
Modified
17 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0072 72.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-42227 is a high-severity Path Traversal (CWE-22) vulnerability in Zucchetti Helpdeskadvanced. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2023-42227 is a directory traversal vulnerability affecting Pat Infinite Solutions HelpdeskAdvanced in versions up to and including 11.0.33. The flaw exists in the WSCView/Save function, which allows attackers to manipulate file paths and access files outside the intended directory. It has a CVSS v3.1 base score of 7.5, rated as High severity, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, no required privileges or user interaction, and high impact on confidentiality.

Unauthenticated attackers can exploit this vulnerability remotely over the network by sending crafted requests to the WSCView/Save endpoint. Successful exploitation enables reading arbitrary files on the server, potentially exposing sensitive information such as configuration files, user data, or system details, without affecting integrity or availability.

Further details are available in the reference at https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md. No specific patch or mitigation guidance is detailed in the provided information.

EU & UK References

Vulnerability details

Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Directory traversal in public-facing web app directly enables remote unauthenticated file read (T1190) and arbitrary local file access (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2023-42226Same product: Zucchetti Helpdeskadvanced
CVE-2023-42232Same product: Zucchetti Helpdeskadvanced
CVE-2023-42225Same product: Zucchetti Helpdeskadvanced
CVE-2023-42231Same product: Zucchetti Helpdeskadvanced
CVE-2023-42228Same product: Zucchetti Helpdeskadvanced
CVE-2025-12824Shared CWE-22
CVE-2026-49136Shared CWE-22
CVE-2026-25965Shared CWE-22
CVE-2025-30567Shared CWE-22
CVE-2025-27098Shared CWE-22

Affected Assets

zucchetti
helpdeskadvanced
≤ 11.0.33

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the directory traversal flaw in the WSCView/Save function through timely identification, reporting, and correction of the vulnerability.

SI-10 Information Input Validation good match
prevent

Validates file path inputs to the WSCView/Save function to block malicious directory traversal sequences like '../'.

SC-7 Boundary Protection partial match
prevent

Deploys boundary protections such as web application firewalls to inspect and block crafted requests exploiting the directory traversal vulnerability.

References