How severe is CVE-2023-2101?

CVE-2023-2101 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2023-2101 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-2101?

CVE-2023-2101 affects Mogublog Project Mogublog. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-2101?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-2101 published?

CVE-2023-2101 was published on 2023-04-15 and last updated on 2026-06-17.

CVE-2023-2101

CVE-2023-2101 is a medium-severity vulnerability in Mogublog Project Mogublog with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-36.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
CVSS v2: 4.0
EPSS exploit prediction: 1% (54th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-36
Affected product: Mogublog Project Mogublog
Published: 2023-04-15
Last modified: 2026-06-17

Description

A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability.

Frequently asked questions

What is CVE-2023-2101?: A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability.
How severe is CVE-2023-2101?: CVE-2023-2101 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2023-2101 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-2101?: CVE-2023-2101 affects Mogublog Project Mogublog. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-2101?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-2101 published?: CVE-2023-2101 was published on 2023-04-15 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mogublog_project:mogublog:*:*:*:*:*:*:*:*

More vulnerabilities in Mogublog Project Mogublog

CVE-2025-13814 — High (CVSS 7.3): A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function…
CVE-2025-13816 — Medium (CVSS 6.3): A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function…
CVE-2025-13815 — Medium (CVSS 6.3): A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the…
CVE-2022-30517 — Medium (CVSS 6.1): Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).
CVE-2025-13813 — Medium (CVSS 5.6): A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the…

All CVEs affecting Mogublog Project Mogublog →

Other CWE-36 vulnerabilities

CVE-2023-3765 — Critical (CVSS 10.0): Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVE-2025-34392 — Critical (CVSS 9.8): Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL…
CVE-2025-0851 — Critical (CVSS 9.8): A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad…
CVE-2024-13161 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
CVE-2024-13160 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…
CVE-2024-13159 — Critical (CVSS 9.8): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security…

Browse all CWE-36 vulnerabilities →