Paper/Archive/CVE-2023-27397

CVE-2023-27397

MicroEngine Inc. MicroEngine Mailform — Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8.

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 60.2.602 × 2012.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.

Affected

ProductAffectedFixed inSource

MicroEngine Mailformversion 1.1.0 to 1.1.8–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmicroengine.jp/information/security_2023_05.html refjvn.jp/en/jp/JVN31701509