CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVE-2023-2978
Medium (4.3) in abstrium pydio cells. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/pydio/cells 4.2.1.
A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Affected
- abstrium:pydio_cells
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mv7x-27pc-8c96 | Go | github.com/pydio/cells | <4.2.1 | 4.2.1 |
| GO-2023-1808 | Go | github.com/pydio/cells | all versions | no fix published |
| GO-2023-1808 | Go | github.com/pydio/cells/v4 | <4.2.1 | 4.2.1 |
References
- https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be
- https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421
- https://vuldb.com/?ctiid.230210
- https://vuldb.com/?id.230210
- https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be