‹ Volver al listado

CVE-2023-28458

Media (4.3)—Exploit
Seguimiento normalGravedad Media 4.3. Existe una prueba de concepto pública, pero no se conoce explotación activa.
Aviso del fabricante· pretalx.com/p/news/security-release-232
Gravedad4.3Media · CVSS 3.1
Probabilidad de explotación3.43 %mayor que el 89 % de las CVE · dato del 8 nov 2026
Explotación activaNono figura en el catálogo de CISA · comprobado 8 nov, 15:00
Exploit públicoDisponibleMódulo de Metasploit (exploit fiable y al alcance de cualquiera)

pretalx 2.3.1 anterior a 2.3.2 permite un recorrido de directorios (path traversal) en la exportación a HTML (una funcionalidad no predeterminada). Los organizadores pueden provocar la sobrescritura (con el contenido de la página 404 estándar de pretalx) de un archivo arbitrario.

Traducción automática del texto original de NVD (en inglés).

Cronología

Elaborada con nuestros propios datos: NVD, CISA KEV, FIRST EPSS, exploits públicos, prensa especializada y la cobertura de Orbitaley.

  1. Registro CVE publicado en NVD
  2. Última modificación del registro en NVD
  3. Primer exploit público

Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Pretalx — Pretalx

Registro NVD

Estado en NVD
Modificada
Publicada
20 abr 2023
Última modificación
17 jun 2026
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Debilidad (CWE)
CWE-22

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-28458",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-28458",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-05T16:15:24.990965Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-04-20T21:15:08.770",
  "references": [
    {
      "url": "https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff320723776890",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pretalx/pretalx/releases/tag/v2.3.2",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://pretalx.com/p/news/security-release-232/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff320723776890",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/pretalx/pretalx/releases/tag/v2.3.2",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pretalx.com/p/news/security-release-232/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file."
    }
  ],
  "lastModified": "2026-06-17T05:47:46.913",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pretalx:pretalx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C032C969-F9AA-4312-B987-0DD4C8BB6D97",
              "versionEndIncluding": "2.3.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}