CWE-610

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "spin-sdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32980"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-08T17:50:49Z",
    "nvd_published_at": "2024-05-08T15:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nSome specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header.\n\nIf an application\u0027s manifest contains a component with configuration such as\n```toml\nallowed_outbound_hosts = [\"http://self\", \"https://self\"]\n```\n\nand code such as\n```rust\n let res: Response = spin_sdk::http::send(\n        Request::new(Method::Get, \"/\") // Note: the request URI does not contain a URL authority\n ).await?;\n```\n\nThen that application can be induced to send an outgoing request to another host (leading the app to process the response assuming it comes from another component in the same application). This can be induced with a request such as\n```shell\ncurl -H\"Host: google.com:80\" localhost:3000 # Assuming the application is served on localhost:3000\n```\n\n\u003e Note: If using a SDK that does not use `wasi:http/outgoing-handler`, the port can be omitted from the URL.\n\n#### Vulnerable Configurations\n\nThe following conditions need to be met for an application to be vulnerable:\n1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to the original value by the client.\n2. The Spin application\u0027s component handling the incoming request is configured with an `allowed_outbound_hosts` list containing `\"self\"`.\n3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\u0027t include the hostname/port.\n\nIf all of these conditions apply, then Spin will use the inbound request\u0027s `Host` header to determine the `authority` part of the URL if none is explicitly provided in the request\u0027s URL.\n\n#### Setups known not to be vulnerable\n\nFermyon\u0027s [Fermyon Cloud](https://developer.fermyon.com/cloud/index) serverless product and applications hosted on it are known not to be vulnerable.\n\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nSpin version 2.4.3 is being released with this advisory going public.\n\n### Workarounds\nFor deployments of Spin, a workaround is to ensure that the `Host` header is sanitized to match the application a request is routed to.\n\nFor individual applications, multiple workarounds exist:\n1. Ensure that outgoing requests always sanitize the `Host` header\n2. Ensure that outgoing requests always provide the hostname in the URL and use that hostname in the `allowed_outbound_hosts` list instead of `self`\n3. When using Spin 2.4, use [application-internal service chaining](https://developer.fermyon.com/spin/v2/http-outbound#local-service-chaining) for intra-application requests\n",
  "id": "GHSA-f3h7-gpjj-wcvh",
  "modified": "2024-05-08T17:50:49Z",
  "published": "2024-05-08T17:50:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32980"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fermyon/spin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spin applications with specific configuration vulnerable to potential network sandbox escape"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phenx/php-svg-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-25117"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-21T18:04:16Z",
    "nvd_published_at": "2024-02-21T17:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nphp-svg-lib fails to validate that font-family doesn\u0027t contain a PHAR url, which might leads to RCE on PHP \u003c 8.0, and doesn\u0027t validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib.\n\n### Details\nThe Style::fromAttributes(), or the Style::parseCssStyle() should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the Style::fromStyleSheets might be reused : \n\n```\n                if (\n                    \\array_key_exists(\"font-family\", $styles)\n                    \u0026\u0026 (\n                        \\strtolower(\\substr($this-\u003ehref, 0, 7)) === \"phar://\"\n                        || ($this-\u003edocument-\u003eallowExternalReferences === false \u0026\u0026 \\strtolower(\\substr($this-\u003ehref, 0, 5)) !== \"data:\")\n                    )\n                ) {\n                    unset($style[\"font-family\"]);\n                }\n```\n\n### PoC \n\nParsing the following SVG : \n\n```\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?\u003e\n\u003csvg xmlns:svg=\"http://www.w3.org/2000/svg\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"200\" height=\"200\"\u003e\n    \u003ctext x=\"20\" y=\"35\" style=\"color:red;font-family:phar:///path/to/whatever.phar/blaklis;\"\u003eMy\u003c/text\u003e\n\u003c/svg\u003e\n```\n\nwill pass the `phar:///path/to/whatever.phar/blaklis` as `$family` in `SurfaceCpdf::setFont`, which is then passed to the canvas `selectFont` as a `$fontName`.\n\n### Impact\nLibraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even RCE, if they do not double check the value of the `fontName` that is passed by php-svg-lib",
  "id": "GHSA-f3qr-qr4x-j273",
  "modified": "2024-02-21T19:33:13Z",
  "published": "2024-02-21T18:04:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25117"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/commit/8ffcc41bbde39f09f94b9760768086f12bbdce42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dompdf/php-svg-lib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "php-svg-lib lacks path validation on font through SVG inline styles "
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-29T13:15:07Z",
    "severity": "MODERATE"
  },
  "details": "A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions \u003c= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes in system behavior or security settings. Additionally, tampering with these configuration files can result in a denial of service (DoS) condition, disrupting normal system operation.",
  "id": "GHSA-f3xm-22x6-vg3g",
  "modified": "2024-10-29T15:32:05Z",
  "published": "2024-10-29T15:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5823"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/720c23d755a4a955dcb0a54e8c200a2247a27f8b"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/ca361701-7d68-4df6-8da0-caad4b85b9ae"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68478"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-19T22:53:13Z",
    "nvd_published_at": "2025-12-19T18:15:51Z",
    "severity": "HIGH"
  },
  "details": "**Vulnerability Overview**\n\nIf an arbitrary path is specified in the request body\u0027s `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is.\n\n**Vulnerable Code**\n\n1. It receives the request body (flow), updates the DB, and then passes it to the file-writing sink.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L154-L168\n    \n    ```python\n    @router.post(\"/\", response_model=FlowRead, status_code=201)\n    async def create_flow(\n        *,\n        session: DbSession,\n        flow: FlowCreate,\n        current_user: CurrentActiveUser,\n    ):\n        try:\n            db_flow = await _new_flow(session=session, flow=flow, user_id=current_user.id)\n            await session.commit()\n            await session.refresh(db_flow)\n    \n            await _save_flow_to_fs(db_flow)\n    \n        except Exception as e:\n    ```\n    \n2. Applies authentication dependency (requires API Key/JWT) when accessing the endpoint.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/utils/core.py#L36-L38\n    \n    ```python\n    CurrentActiveUser = Annotated[User, Depends(get_current_active_user)]\n    CurrentActiveMCPUser = Annotated[User, Depends(get_current_active_user_mcp)]\n    DbSession = Annotated[AsyncSession, Depends(get_session)]\n    ```\n    \n3. The client can directly specify the save path, including `fs_path`.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L66-L70\n    \n    ```python\n    ):\n        try:\n            await _verify_fs_path(flow.fs_path)\n    \n            \"\"\"Create a new flow.\"\"\"\n    ```\n    \n4. It attempts to create the file (or *the* file, in the case of a path without a parent) directly without path validation.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L45-L49\n    \n    ```python\n    async def _verify_fs_path(path: str | None) -\u003e None:\n        if path:\n            path_ = Path(path)\n            if not await path_.exists():\n                await path_.touch()\n    ```\n    \n5. Serializes the Flow object to JSON and writes it to the specified path in \"w\" mode (overwriting).\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L52-L58\n    \n    ```python\n    async def _save_flow_to_fs(flow: Flow) -\u003e None:\n        if flow.fs_path:\n            async with async_open(flow.fs_path, \"w\") as f:\n                try:\n                    await f.write(flow.model_dump_json())\n                except OSError:\n                    await logger.aexception(\"Failed to write flow %s to path %s\", flow.name, flow.fs_path)\n    ```\n    \n\n**PoC Description**\n\nWhen an authenticated user passes an arbitrary path in `fs_path`, the Flow JSON is written to that path. Since `/tmp` is usually writable, it is easy to reproduce. In a production environment, writing to system-protected directories may fail depending on permissions.\n\n**PoC**\n\n- **Before Exploit**\n   \n\n    \u003cimg width=\"1918\" height=\"658\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fe3c2306-091d-4cb0-b4dc-c7fb63c03d8d\" /\u003e\n    \n- **After Exploit**\n    \n    ```bash\n    curl -sS -X POST \"http://localhost:7860/api/v1/flows/\" \\\n      -H \"Content-Type: application/json\" \\\n      -H \"x-api-key: sk-8Kyzf9IQ-UEJ_OtSTaJq4eniMT9_JKgZ7__q8PNkoxc\" \\\n      -d \u0027{\"name\":\"poc-etc\",\"data\":{\"nodes\":[],\"edges\":[]},\"fs_path\":\"/tmp/POC.txt\"}\u0027\n    ```\n    \n    \u003cimg width=\"1918\" height=\"742\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cc0b0c96-1c2d-4d56-b558-5ba97e0ec174\" /\u003e\n    \n\n### Impact\n\n- **Authenticated Arbitrary File Write (within server permission scope):** Risk of corrupting configuration/log/task files, disrupting application behavior, and tampering with files read by other components.\n- **Both absolute and relative paths are allowed, enabling base directory traversal.** The risk of overwriting system files increases in environments with root privileges or weak mount/permission settings.\n- **The file content is limited to Flow JSON,** but the impact is severe if the target file is parsed by a JSON parser or is subject to subsequent processing.\n- **In production environments, it is essential to enforce a save root, normalize paths, block symlink traversal, and minimize permissions.**",
  "id": "GHSA-f43r-cc68-gpx4",
  "modified": "2026-06-06T00:36:53Z",
  "published": "2025-12-19T22:53:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-f43r-cc68-gpx4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68478"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2025-125.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "External Control of File Name or Path in Langflow"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-24241"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-02T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.",
  "id": "GHSA-f62f-hw25-5gjf",
  "modified": "2022-06-12T00:00:47Z",
  "published": "2022-06-03T00:01:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24241"
    },
    {
      "type": "WEB",
      "url": "https://www.aceware.com/forum/viewtopic.php?f=7\u0026t=481"
    },
    {
      "type": "WEB",
      "url": "http://aceware.com"
    },
    {
      "type": "WEB",
      "url": "http://aceweb.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-32761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-22T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.",
  "id": "GHSA-f6vj-43fg-42hg",
  "modified": "2022-08-27T00:00:50Z",
  "published": "2022-08-23T00:00:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32761"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1549"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-22616"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-12T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.",
  "id": "GHSA-f9jq-jhvv-4xmw",
  "modified": "2024-04-04T03:25:22Z",
  "published": "2023-04-12T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22616"
    },
    {
      "type": "WEB",
      "url": "https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode"
    },
    {
      "type": "WEB",
      "url": "https://www.insyde.com/security-pledge"
    },
    {
      "type": "WEB",
      "url": "https://www.insyde.com/security-pledge/SA-2023022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-78966"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T21:17:52Z",
    "severity": "MODERATE"
  },
  "details": "Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-fqgj-rwhh-459j",
  "modified": "2026-08-28T00:31:57Z",
  "published": "2026-08-25T21:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78966"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/497637694"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-11140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-29T04:15:40Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-fqqp-7v7w-5xhp",
  "modified": "2025-09-29T06:30:27Z",
  "published": "2025-09-29T06:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FightingLzn9/vul/blob/main/%E6%97%B6%E7%A9%BA%E6%99%BA%E5%8F%8Berp-3.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.326217"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.326217"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.658090"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-37856"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-09T07:15:10Z",
    "severity": "MODERATE"
  },
  "details": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser .\n\n",
  "id": "GHSA-fqxx-3fhv-wcpr",
  "modified": "2024-04-04T06:43:28Z",
  "published": "2023-08-09T09:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37856"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2023-018"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}