CVE-2023-51232

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-51232
Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via crafted request to the /logs endpoint. This may be restricted to certain file names that start with a dot ('.').

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/dagster-io/dagster/pull/18462
https://github.com/dagster-io/dagster/pull/18462
Configurations

No configuration.

History

08 Jul 2025, 18:15

Type Values Removed Values Added
CWE CWE-22
References () https://github.com/dagster-io/dagster/pull/18462 - () https://github.com/dagster-io/dagster/pull/18462 -
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de Directory Traversal en dagster-webserver Dagster thru 1.5.11 que permite a atacantes remotos obtener información confidencial mediante una solicitud manipulada al endpoint /logs. Esto puede estar restringido a ciertos nombres de archivo que empiezan con un punto ('.').

07 Jul 2025, 16:15

Type Values Removed Values Added
Summary (en) Directory Traversal vulnerability in dagster-webserver Dagster thru 1.0.3 allows remote attackers to obtain sensitive information via crafted request to the /logs endpoint. This may be restricted to certain file names that start with a dot ('.'). (en) Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via crafted request to the /logs endpoint. This may be restricted to certain file names that start with a dot ('.').

07 Jul 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-07 14:15

Updated : 2025-07-08 18:15

NVD link : CVE-2023-51232

Mitre link : CVE-2023-51232

CVE.ORG link : CVE-2023-51232

JSON object : View

Products Affected

No product.

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')