CVEvulnerability

CVE-2021-23835

4.9 MEDIUM Published 2021-01-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-01-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-20

Description

An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docs_file HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter (which retrieves the contents of the specified file) was found to be accepting malicious user input without proper sanitization, thus leading to retrieval of backend server sensitive files, e.g., /etc/passwd, SQLite database files, PHP source code, etc.

Affected configurations

• flatcore flatcore (<= 2.0.0)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References