by Kastro
Paper/Archive/CVE-2023-32637

CVE-2023-32637

Generic Model Organism Database Project GBrowse — GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.9.659 × 2013.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.

Affected

ProductAffectedFixed inSource
GBrowseunspecified–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgmod.org/wiki/GBrowserefjbrowse.org/jb2refjvn.jp/en/jp/JVN35897618