CVE-2023-29919

CRITICALNuclei

contec solarview_compact Incorrect Default Permissions

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-29919 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 25, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 17, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

solarview_compact

Browse contec / solarview_compact
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubxiaosed/CVE-2023-29919Repository PoCby xiaosed0Not analyzed1 file

530 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALSolarView Compact <= 6.00 - Local File InclusionCVSS 9.1

There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php

Impact

An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.

Remediation

Upgrade to a patched version of SolarView Compact or apply the vendor-provided security patch to mitigate the LFI vulnerability.

WeaknessesCWE-276
AuthorsFor3stCo1d
Template tagscvecve2023lfisolarviewedbcontecvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CPE: cpe:2.3:h:contec:solarview_compact:-:*:*:*:*:*:*:*
Shodan: http.html:"SolarView Compact"
Shodan: cpe:"cpe:2.3:h:contec:solarview_compact"
https://github.com/xiaosed/CVE-2023-29919 https://nvd.nist.gov/vuln/detail/CVE-2023-29919 https://www.solarview.io/ https://github.com/nomi-sec/PoC-in-GitHub

Source: ProjectDiscovery

References

3