CVE-2023-4171

CVE-2023-4171 is a path traversal vulnerability impacting the Chengdu Flash Flood Disaster Monitoring and Warning System 2.0, specifically within the FileDownload.ashx component. An unauthenticated attacker can remotely manipulate the 'Files' argument to access arbitrary files outside the intended directory. The vulnerability has a CVSS score of 5.3 (Medium), indicating low attack complexity and no user interaction required, but only allows for information disclosure (C:L) without impacting integrity or availability. Its EPSS score is very low, suggesting a minimal probability of exploitation in the wild. While the exploit has been publicly disclosed, there is no evidence of active exploitation, nor are there readily available exploits in common frameworks like Metasploit or Nuclei. Community discussion and media coverage are also absent, indicating low current attention.