CVE-2023-28465

Published: Dic 12, 2023 Last Modified: Mag 27, 2025
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0055
Percentile
0,7th
Updated

EPSS Score Trend (Last 90 Days)

22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
Application

Hl7 Fhir Core by Hapifhir

Product Information
Vendor Hapifhir
Product Hl7 Fhir Core
Version Range Affected
To 5.6.106 (exclusive)
cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/advisories/GHSA-9654-pr4f-gh6m
Third Party Advisory
https://github.com/advisories/GHSA-9654-pr4f-gh6m
https://www.smilecdr.com/our-blog
Not Applicable
https://www.smilecdr.com/our-blog
https://www.smilecdr.com/our-blog/statement-on-cve-2023-240…
Broken Link
https://www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-hea…
https://github.com/advisories/GHSA-9654-pr4f-gh6m
Third Party Advisory
https://github.com/advisories/GHSA-9654-pr4f-gh6m
https://www.smilecdr.com/our-blog
Not Applicable
https://www.smilecdr.com/our-blog
https://www.smilecdr.com/our-blog/statement-on-cve-2023-240…
Broken Link
https://www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-hea…