Lucene search

[email protected]CVE-2023-25132

HistoryApr 24, 2023 - 10:15 a.m.

CVE-2023-25132

2023-04-2410:15:07

CWE-434

[email protected]

web.nvd.nist.gov

cve-2023-25132

unrestricted upload

file upload vulnerability

powerpanel business

os command execution

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.0%

JSON

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.

Affected configurations

NVD

Node

cyberpowerpowerpanelRange≤4.8.6businesslinux

cyberpowerpowerpanelRange≤4.8.6businessmacos

cyberpowerpowerpanelRange≤4.8.6businessvirtual_machine

cyberpowerpowerpanelRange≤4.8.6businesswindows

CPENameOperatorVersion
cyberpower:powerpanelcyberpower powerpanelle4.8.6

CPE	Name	Operator	Version
cyberpower:powerpanel	cyberpower powerpanel	le	4.8.6

CNA Affected

[
  {
    "vendor": "CyberPower",
    "product": "PowerPanel Business Local / Remote",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "v4.8.6",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Windows, MacOS, Linux"
    ]
  },
  {
    "vendor": "CyberPower",
    "product": "PowerPanel Business Management",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "v4.8.6",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Windows, MacOS, Linux"
    ]
  }
]

References

www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads

www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads

www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads

www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

zuso.ai/Advisory/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.0%

JSON

Related for CVE-2023-25132

nvd1 prion1 cvelist1