CVE-2023-26578

Summary

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.

Affected Software

Weaknesses

• CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CVE Program Container

Additional References

• https://www.themissinglink.com.au/security-advisories/cve-2023-26578

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.themissinglink.com.au/security-advisories/cve-2023-26578

• ←Previous
• Next→