CVE-2023-40517 - CVE House
Back to Database
Status published High CVE-2023-40517

LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability

Vulnerability Description

LG SuperSign Media Editor ContentRestController getObject Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getObject method implemented in the ContentRestController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20328.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40517

Credits & Attribution

No credits recorded in the NVD database.

References

More from LG

View All →
CVE-2023-6320
Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint
Critical 9.1
CVE-2023-6319
Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
Critical 9.1
CVE-2023-6318
Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service
Critical 9.1
CVE-2023-6317
PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction
High 7.2
CVE-2023-41181
LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability
Medium 5.3

Affected Vendor

Affected Software

SuperSign Media Editor
Vulnerable Versions:
3.11.3_20171108

Timeline

Official Publish: May 3rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact