Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-10768
HistoryJan 21, 2022 - 12:00 a.m.

Saraban file upload vulnerability

2022-01-2100:00:00
China National Vulnerability Database
www.cnvd.org.cn
5

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

Saraban is a file management system from Softvibe Thailand. It is used to transfer files and notifications to reduce unnecessary duplication.A file upload vulnerability exists in Saraban, which stems from the application’s file upload feature that does not properly perform access control and file type restrictions, and can be exploited by attackers to upload files with any file extension, leading to arbitrary code execution.

CPENameOperatorVersion
softvibe sarabaneq1.1

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

Related for CNVD-2022-10768