Paper/Archive/CVE-2023-27178

CVE-2023-27178

mitre — An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a craft…

EPSS 1%CVSS 9.8

critical.is priorityof 100

44

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 71.8.718 × 2014.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted file.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsalsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6 refgdidees.eu/cms-1-0.html refnvd.nist.gov/vuln/detail/CVE-2022-40797 refgist.github.com/Hadi999/4bc173bfb802c229b9bb397fa906847b