CVE-2023-52252

2023-12-3000:00:00

mitre

www.cve.org

cve-2023-52252

access-control-allow-origin

remote upload endpoint

security vulnerability

lua code execution

AI Score

Confidence

High

EPSS

0.018

Percentile

88.4%

JSON

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.

References

harkenzo.tlstickle.com/2023-03-17-UR-Web-Triggerable-RCE/

www.exploit-db.com/exploits/51309