CVE-2023-40513 - CVE House
Back to Database
Status published Medium CVE-2023-40513

LG Simple Editor UserManageController getImageByFilename Directory Traversal Information Disclosure Vulnerability

Vulnerability Description

LG Simple Editor UserManageController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the getImageByFilename method in the UserManageController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. . Was ZDI-CAN-20015.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40513

Credits & Attribution

No credits recorded in the NVD database.

References

More from LG

View All →
CVE-2023-6320
Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint
Critical 9.1
CVE-2023-6319
Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
Critical 9.1
CVE-2023-6318
Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
Critical 9.1
CVE-2023-6317
PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction
High 7.2
CVE-2023-41181
LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability
Medium 5.3

Affected Vendor

Affected Software

Simple Editor
Vulnerable Versions:
LG Simple Editor 3.21.0

Timeline

Official Publish: May 3rd, 2024
Last Modified: September 18th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact