Lucene search

TwcertCVE-2023-37289

HistoryJul 20, 2023 - 3:15 a.m.

CVE-2023-37289

2023-07-2003:15:10

CWE-434

twcert

web.nvd.nist.gov

cve-2023-37289

vulnerability

unrestricted upload

file upload

infodoc

document on-line submission

approval system

22547

22567

nvd

security

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

72.6%

JSON

It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit this vulnerability without logging system to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service. This issue affects Document On-line Submission and Approval System: 22547, 22567.

Affected configurations

Nvd

Node

infodocdocument_on-line_submission_and_approval_systemMatch22547

infodocdocument_on-line_submission_and_approval_systemMatch22567

VendorProductVersionCPE
infodocdocument_on-line_submission_and_approval_system22547cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22547:*:*:*:*:*:*:*
infodocdocument_on-line_submission_and_approval_system22567cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22567:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
infodoc	document_on-line_submission_and_approval_system	22547	cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22547:::::::*
infodoc	document_on-line_submission_and_approval_system	22567	cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22567:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Document On-line Submission and Approval System",
    "vendor": "InfoDoc",
    "versions": [
      {
        "status": "affected",
        "version": "22547"
      },
      {
        "status": "affected",
        "version": "22567"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7225-cef32-1.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

72.6%

JSON

Related for CVE-2023-37289