This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
Metrics
Affected Vendors & Products
References
History
Mon, 30 Sep 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: LGE
Published: 2023-09-04T08:16:27.817Z
Updated: 2024-09-30T18:50:46.494Z
Reserved: 2023-08-30T08:06:37.751Z
Link: CVE-2023-4613
Vulnrichment
Updated: 2024-08-02T07:31:06.542Z
NVD
Status : Analyzed
Published: 2023-09-04T09:15:07.510
Modified: 2023-09-08T14:14:54.583
Link: CVE-2023-4613
Redhat
No data.