Lucene search

Fluid AttacksCVELIST:CVE-2023-4122

HistoryDec 07, 2023 - 11:10 p.m.

CVE-2023-4122 Student Information System v1.0 - Insecure File Upload

2023-12-0723:10:04

CWE-434

Fluid Attacks

www.cve.org

cve-2023-4122

student information system

insecure file upload

my-profile page

remote code execution

authenticated attacker

server hosting the application

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the ‘photo’ parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Student Information System",
    "vendor": "Kashipara Group",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

References

fluidattacks.com/advisories/rubinstein/

www.kashipara.com/

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

Related for CVELIST:CVE-2023-4122