Skip to content
CVE Tracker
Back

CVE-2016-20023

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file…

Medium5.0EPSS 0.34%
Published
Updated
Reserved
Assigned by
mitre

Description

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

Scores

CVSS scores of CVE-2016-20023, by who scored it
Scored byCVSSScoreVector
mitreCNA (assigner)3.1Medium5.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
NVDNVD · Analyzed3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.34% · top 72% of all CVEs (3 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

Affected products

  • CKSource · CKFinder

    • affected 2 – < 2.5.0.1

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .