CVE-2023-4480 - CVE House
Back to Database
Status published Medium CVE-2023-4480

Arbitrary File Read in Fusion File Manager

Vulnerability Description

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation. 

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-4480

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Dharani Sri Penumacha

References

More from PHPFusion

View All →
CVE-2023-2453
Local file Inclusion (LFI) in Forum Infusion via Directory Traversal
High 8.8

Affected Vendor

Affected Software

PHPFusion
Vulnerable Versions:
0

Timeline

Official Publish: September 5th, 2023
Last Modified: September 26th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-538

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.