A vulnerability was found in Chameleon Power 1.0 and classified as problematic. Affected by this issue is an unknown code. The manipulation of the argument getImage with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-35. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. Impacted is confidentiality. CVE summarizes:

Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files located on the server and gain access to sensitive information such as configuration files.

The weakness was shared 11/22/2023 by Daniel Martínez Adan. The advisory is shared for download at incibe.es. This vulnerability is handled as CVE-2023-6252 since 11/22/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Chameleon

Name

• Power

Version

• 1.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion