Lucene search

TwcertCVELIST:CVE-2023-28699

HistoryJun 02, 2023 - 12:00 a.m.

CVE-2023-28699 WADE DIGITAL DESIGN CO, LTD. FANTSY - Arbitrary File Upload

2023-06-0200:00:00

CWE-434

twcert

www.cve.org

fantsy

file upload

remote attacker

webshell

system operation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

47.3%

JSON

Wade Graphic Design FANTSY has a vulnerability of insufficient filtering for file type in its file update function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload a PHP file containing a webshell to perform arbitrary system operation or disrupt service.

CNA Affected

[
  {
    "vendor": "WADE DIGITAL DESIGN CO, LTD.",
    "product": "FANTSY",
    "versions": [
      {
        "version": "2.1.8",
        "status": "affected"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7102-41ab8-1.html

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

47.3%

JSON

Related for CVELIST:CVE-2023-28699